3 0Day in SonicWall Enterprise Email Security products actively exploited
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-20021 +1 in the same advisory: …20022 | Improper Privilege Management in SonicWall Email Security 10.0.9.x Grants Admin Access CVE-2021-20021 is an improper privilege management flaw (CWE-269) in SonicWall Email Security version 10.0.9.x. An unauthenticated remote attacker can trigger it by sending a crafted HTTP request to the vulnerable host, which allows the attacker to create a new administrative account on the Email Security instance. That administrative access gives an attacker full control over the email security platform (CVSS 9.8 with high confidentiality, integrity, and availability impact), enabling persistence, manipulation of email filtering, and a foothold from which to target downstream mail infrastructure. Any organization running SonicWall Email Security 10.0.9.x is affected, whether on hardware appliances (3300, 4300, 5050, 7050, 8300, 9000, 5000, 7000), as a virtual appliance, or via the hosted service. The flaw is being actively exploited in the wild: it was added to CISA's KEV on 2021-11-03 with known ransomware use (headlines tie SonicWall email appliance attacks to the HelloKitty gang), and EPSS estimates an 83.4% probability of exploitation within 30 days (100th percentile). Do: Upgrade SonicWall Email Security from 10.0.9.x to the latest patched release per SonicWall's instructions, as required by CISA KEV. Audit the deployment for unrecognized administrative accounts created by attackers, review management-interface HTTP logs for suspicious requests, and restrict exposure of the management interface to trusted networks. Because this bug was one of three SonicWall zero-days actively exploited with known ransomware use (HelloKitty), also hunt for signs of compromise and follow-on ransomware activity. | 9.8 group max | 83% | KEV ransomware |
| large≈ tens of thousands of deployments (order of 10k–100k systems) | |
| CVE-2021-20023 | Post-Auth Path Traversal Arbitrary File Read in SonicWall Email Security 10.0.9.x CVE-2021-20023 is a path traversal flaw (CWE-22) in SonicWall Email Security version 10.0.9.x that allows an attacker who has already authenticated to the product to read arbitrary files on the remote host via a crafted request. Because it is network-exploitable, requires only high-privileged (admin-level) credentials, and needs no user interaction, it is typically triggered with an administrator account or credentials compromised by an attacker. Successful exploitation exposes sensitive file contents, potentially including configuration data or credentials that enable follow-on compromise, and CISA notes known ransomware use. It affects organizations running SonicWall Email Security on hardware appliances (3300, 4300, 8300, 5000, 7000, 5050, 7050, 9000), the virtual appliance, and the hosted service. The flaw is being actively exploited: it was added to the CISA KEV on 2021-11-03 and headlines describe it as one of three zero-days actively exploited in SonicWall Email Security products in the wild. Do: Upgrade all Email Security deployments (hardware appliances, virtual appliance, hosted) off the vulnerable 10.0.9.x line to SonicWall's patched release per the vendor's instructions. Because exploitation requires authenticated admin access, restrict the management interface to trusted admin networks or VPN, review and rotate administrator credentials, and check for signs of compromise (unexpected admin logins, unusual file reads) given the known ransomware use. Prioritize patching internet-reachable appliances, as the flaw is listed in the CISA KEV and federal remediation is required. | 4.9 | 51% | KEV ransomware |
| largeroughly tens of thousands of appliance/virtual-appliance deployments plus hosted tenants (order-of-magnitude estimate) |
Full article701 words · extracted from securityaffairs.com · click to collapse
Security vendor SonicWall has addressed three zero-day vulnerabilities affecting both its on-premises and hosted Email Security products.
SonicWall is warning its customers to update their hosted and on-premises email security products to address three zero-day vulnerabilities that are being actively exploited in the wild.
The three vulnerabilities addressed by the security vendor are:
- CVE-2021-20021: Email Security Pre-Authentication Administrative Account Creation: A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
- CVE-2021-20022: Email Security Post-Authentication Arbitrary File Creation: SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
- CVE-2021-20023: Email Security Post-Authentication Arbitrary File Read: SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
The CVE-2021-20021 and CVE-2021-20022 flaws were discovered by FireEye’s Mandiant team on March 26, 2021 while investigating an attack against one of its customers using an instance of SonicWall’s Email Security (ES) application running on a Windows Server 2012 installation. The CVE-2021-20023 flaw was also discovered by FireEye and reported to the SonicWall Product Security and Incident Response Team (PSIRT) on April 6, 2021.
“In March 2021, Mandiant Managed Defense identified three zero-day vulnerabilities in SonicWall’s Email Security (ES) product that were being exploited in the wild. These vulnerabilities were executed in conjunction to obtain administrative access and code execution on a SonicWall ES device.” reads the advisory published by FireEye. “The adversary leveraged these vulnerabilities, with intimate knowledge of the SonicWall application, to install a backdoor, access files and emails, and move laterally into the victim organization’s network.”
FireEye researchers provided details about the way threat actors, tracked as UNC2682, exploited the issues.
Attackers exploited the CVE-2021-200221 and CVE-2021-20023 flaws to gain administrative access to the device and access configuration files to gather intelligence on existing accounts and read Active Directory credentials. The attackers leveraged the CVE-2021-20022 issue to upload a crafted ZIP archive containing a JSP-based web shell called BEHINDER. The BEHINDER is a publicly available, multi-platform web shell that allows attackers to establish encrypted connections with command and control (C2).
“With the addition of a web shell to the server, the adversary had unrestricted access to the command prompt, with the inherited permissions of the NT AUTHORITY\SYSTEM account.” continues the analysis published by FireEye.
“After clearing the SonicWall application “webui.json” log file, the adversary escalated their attack to credential harvesting in preparation of moving laterally into the victim’s network. The adversary relied on “living off the land” techniques rather than bringing their own tools into the environment, which often has the benefit of potentially avoiding detections from a security product.”
SonicWall is urging it customers to update the their installs
“Through the course of standard collaboration and testing, SonicWall has verified, tested and published patches to mitigate three zero-day vulnerabilities to its hosted and on-premises email security products.” reads the advisory published by the security vendor.
“In at least one known case, these vulnerabilities have been observed to be exploited ‘in the wild.’ It is imperative that organizations using SonicWall Email Security hardware appliances, virtual appliances or software installation on Microsoft Windows Server immediately upgrade to the respective SonicWall Email Security version listed below.”
The company published a step-by-step guidance on how to apply the updates, the following table provides additional details about affected versions.
| AFFECTED VERSION | PATCHED VERSION | PSIRT ADVISORY ID | APPLICABLE CVEs |
| Email Security (ES) 10.0.4-PresentEmail Security 10.0.3Email Security 10.0.2Email Security 10.0.1 | Email Security 10.0.9.6173 (Windows) | SNWLID-2021-0007SNWLID-2021-0008SNWLID-2021-0010 | CVE-2021-20021CVE-2021-20022CVE-2021-20023 |
| Email Security (ES) 10.0.4-PresentEmail Security 10.0.3Email Security 10.0.2Email Security 10.0.1 | Email Security 10.0.9.6177 (Hardware & ESXi Virtual Appliance) | SNWLID-2021-0007SNWLID-2021-0008SNWLID-2021-0010 | CVE-2021-20021CVE-2021-20022CVE-2021-20023 |
| Hosted Email Security (HES) 10.0.4-PresentHosted Email Security 10.0.3Hosted Email Security 10.0.2Hosted Email Security 10.0.1 | Hosted Email Security 10.0.9.6173 (Patched Automatically) | SNWLID-2021-0007SNWLID-2021-0008SNWLID-2021-0010 | CVE-2021-20021CVE-2021-20022CVE-2021-20023 |
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, SonicWall)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/117075/hacking/sonicwall-es-zerodays.html