SonicWall SonicOS 7.0 - Open Redirect

mediumseverity

6.1CVSS score

13%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

SonicWall SonicOS 7.0 contains an open redirect vulnerability. The values of the Host headers are implicitly set as trusted. An attacker can spoof a particular host header, allowing the attacker to render arbitrary links, obtain sensitive information, modify data, execute unauthorized operations. and/or possibly redirect a user to a malicious site.

Impact

Attackers can redirect users to malicious sites, steal sensitive information, or perform unauthorized operations, leading to potential data breaches or phishing attacks.

Fix

Implement proper validation and sanitization of Host headers to prevent spoofing and open redirects.

How to confirm it

Send: GET {{BaseURL}}/
Positive when: contains "https://{{randstr}}.tld/auth.html" and "Please be patient as you are being re-directed" AND status 200

Run it with nuclei: nuclei -id CVE-2021-20031 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-20031

info:
  name: SonicWall SonicOS 7.0 - Open Redirect
  author: gy741
  severity: medium
  description: SonicWall SonicOS 7.0 contains an open redirect vulnerability. The values of the Host headers are implicitly set as trusted. An attacker can spoof a particular host header, allowing the attacker to render arbitrary links, obtain sensitive information, modify data, execute unauthorized operations. and/or possibly redirect a user to a malicious site.
  impact: |
    Attackers can redirect users to malicious sites, steal sensitive information, or perform unauthorized operations, leading to potential data breaches or phishing attacks.
  remediation: |
    Implement proper validation and sanitization of Host headers to prevent spoofing and open redirects.
  reference:
    - https://www.exploit-db.com/exploits/50414
    - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0019
    - http://packetstormsecurity.com/files/164502/Sonicwall-SonicOS-7.0-Host-Header-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-20031
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-20031
    cwe-id: CWE-601
    epss-score: 0.12984
    epss-percentile: 0.9636
    cpe: cpe:2.3:h:sonicwall:nsa_2650:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: sonicwall
    product: nsa_2650
    google-query: inurl:"auth.html" intitle:"SonicWall"
  tags: cve,cve2021,sonicwall,redirect,edb,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    headers:
      Host: "{{randstr}}.tld"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'https://{{randstr}}.tld/auth.html'
          - 'Please be patient as you are being re-directed'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from