SonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account Creation

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

88.8%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

Impact

Attackers can create admin accounts remotely, leading to full control over the email security system.

Fix

Update to the latest version of SonicWall Email Security or apply security patches provided by SonicWall.

How to confirm it

Send: GET {{BaseURL}}/login.html
Positive when: status_code == 200 and compare_versions(version, " <= 10.0.9") and contains(body, "logonTitle\">Email Security Login") and contains(header, "Apache-Coyote/1.1")

Run it with nuclei: nuclei -id CVE-2021-20021 -u <target>

The full check

id: CVE-2021-20021

info:
  name: SonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account Creation
  author: pussycat0x
  severity: critical
  description: |
    SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
  impact: |
    Attackers can create admin accounts remotely, leading to full control over the email security system.
  remediation: |
    Update to the latest version of SonicWall Email Security or apply security patches provided by SonicWall.
  reference:
    - https://www.sonicwall.com/support/product-notification/security-notice-sonicwall-email-security-zero-day-vulnerabilities/210416112932360
    - https://nvd.nist.gov/vuln/detail/CVE-2021-20021
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-20021
    cwe-id: CWE-269
    epss-score: 0.8878
    epss-percentile: 0.99777
    cpe: cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    shodan-query: product:"SonicWALL Email Security"
    vendor: sonicwall
    product: email_security
  tags: cve,cve2021,sonicwall,email-security,auth-bypass,kev,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.html"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'compare_versions(version, " <= 10.0.9")'
          - 'contains(body, "logonTitle\">Email Security Login")'
          - 'contains(header, "Apache-Coyote/1.1")'
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        regex:
          - 'class="lefthand">([0-9.]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from