Security Affairspublished Apr 10, 15:35 UTC (Apr 10, 2023)ingested Sep 10, 06:12 UTC@securityaffairs

Sophos patches three issues in Sophos Web Security appliance

criticalVulnerabilityimportance 60CVE-2023-1671 CVE-2022-4934 CVE-2020-36692

Read the original

Tagscve-2023-1671 cve-2022-4934 cve-2020-36692 vulnerability

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2023-1671 +2 in the same advisory: …4934 …36692	Command Injection RCE in Sophos Web Appliance Warn-Proceed Handler Sophos Web Appliance contains a command injection flaw (CWE-77) in the handler that processes 'warn and proceed' requests from the appliance's block page, allowing untrusted input to reach a shell command. An attacker who can reach the warn-proceed endpoint sends a crafted request whose parameters inject arbitrary operating system commands, resulting in remote code execution on the appliance. Successful exploitation gives the attacker control of the appliance host, a foothold at the network perimeter, and a platform for follow-on actions such as credential theft or lateral movement. Any organization running Sophos Web Appliance, especially where the appliance's web interface or warning pages are reachable from the internet, is affected. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-11-16, and EPSS assigns it a 100% probability of exploitation in the next 30 days, though no public proof-of-concept is known. Do: Update Sophos Web Appliance to the fixed release identified in Sophos's advisory and confirm the running build is patched; restrict access to the appliance's web interface to trusted networks and review access logs for suspicious requests to the warn-proceed endpoint. If mitigations are unavailable or the deployment is on an unsupported build, follow the CISA KEV required action and discontinue use of the product.	9.8 group max	100%	KEV PoC	Sophos Web Appliance Affected version ranges not enumerated in source data; per the vendor advisory, releases prior to the patched build are vulnerable — apply the vendor's fixed re	moderate≈ low thousands of appliances (on-prem secure web gateway; public scans show only a few thousand internet-exposed instances)	Apr 4, 2023

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2023-1671

+2 in the same advisory: …4934 …36692

Command Injection RCE in Sophos Web Appliance Warn-Proceed Handler

Sophos Web Appliance contains a command injection flaw (CWE-77) in the handler that processes 'warn and proceed' requests from the appliance's block page, allowing untrusted input to reach a shell command. An attacker who can reach the warn-proceed endpoint sends a crafted request whose parameters inject arbitrary operating system commands, resulting in remote code execution on the appliance. Successful exploitation gives the attacker control of the appliance host, a foothold at the network perimeter, and a platform for follow-on actions such as credential theft or lateral movement. Any organization running Sophos Web Appliance, especially where the appliance's web interface or warning pages are reachable from the internet, is affected. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-11-16, and EPSS assigns it a 100% probability of exploitation in the next 30 days, though no public proof-of-concept is known.

Do: Update Sophos Web Appliance to the fixed release identified in Sophos's advisory and confirm the running build is patched; restrict access to the appliance's web interface to trusted networks and review access logs for suspicious requests to the warn-proceed endpoint. If mitigations are unavailable or the deployment is on an unsupported build, follow the CISA KEV required action and discontinue use of the product.

9.8

group max

100%

KEV PoC

Sophos Web Appliance Affected version ranges not enumerated in source data; per the vendor advisory, releases prior to the patched build are vulnerable — apply the vendor's fixed re

moderate≈ low thousands of appliances (on-prem secure web gateway; public scans show only a few thousand internet-exposed instances)

Apr 4, 2023

Full article278 words · extracted from securityaffairs.com · click to collapse

Sophos addressed three vulnerabilities in Sophos Web Appliance, including a critical flaw that can lead to code execution.

Cybersecurity vendor Sophos addressed three vulnerabilities in Sophos Web Appliance, including a critical flaw, tracked as CVE-2023-1671 (CVSS score of 9.8), that can lead to code execution.

The CVE-2023-1671 flaw is a pre-auth command injection issue that resides in the warn-proceed handler, it affects appliances older than version 4.3.10.4.

The company also addressed a high-severity code execution issue, tracked as CVE-2022-4934. The issue is a post-auth command injection vulnerability that resides in the exception wizard, it can allow administrators to execute arbitrary code.

The vendor also fixed a medium-severity reflected cross-site scripting (XSS) vulnerability tracked as CVE-2020-36692. An attacker can exploit the vulnerability to execute JavaScript code in the victim’s browser.

The attacker can trigger the flaw by tricking the victim into submitting a malicious form on an attacker-controlled website while logged into Sophos Web Appliance.

All the above vulnerabilities were discovered and responsibly disclosed to Sophos by external security researchers via the Sophos bug bounty program.

Sophos Web Appliance will reach end-of-life (EoL) status on July 20, 2023. The company recommends customers replace the appliances with Sophos Firewall.

Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections:

The Teacher – Most Educational Blog
The Entertainer – Most Entertaining Blog
The Tech Whizz – Best Technical Blog
Best Social Media Account to Follow (@securityaffairs)

Please nominate Security Affairs as your favorite blog.

Nominate here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Sophos)

Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/144623/security/sophos-web-appliance-flaws.html