Sophos Firewall <=18.5 MR3 - Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-03-31; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.8%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to complete compromise of the firewall.

Fix

Upgrade to a patched version of Sophos Firewall (>=18.5 MR4) to mitigate this vulnerability.

How to confirm it

Send: POST {{BaseURL}}/userportal/Controller?mode=8700&operation=1&datagrid=179&json={"🦞":"test"}
Positive when: contains "{\"status\":\"Session Expired\"}" AND contains in header "Server: xxxx" AND status 200

Run it with nuclei: nuclei -id CVE-2022-1040 -u <target>

The full check

id: CVE-2022-1040

info:
  name: Sophos Firewall <=18.5 MR3 - Remote Code Execution
  author: For3stCo1d
  severity: critical
  description: |
    Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to complete compromise of the firewall.
  remediation: |
    Upgrade to a patched version of Sophos Firewall (>=18.5 MR4) to mitigate this vulnerability.
  reference:
    - https://github.com/killvxk/CVE-2022-1040
    - https://github.com/CronUp/Vulnerabilidades/blob/main/CVE-2022-1040_checker
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1040
    - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce
    - https://github.com/Mr-xn/Penetration_Testing_POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-1040
    cwe-id: CWE-287
    epss-score: 0.99796
    epss-percentile: 0.99958
    cpe: cpe:2.3:o:sophos:sfos:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: sophos
    product: sfos
    shodan-query:
      - http.title:"Sophos"
      - http.title:"sophos"
    fofa-query: title="sophos"
    google-query: intitle:"sophos"
  tags: cve,cve2022,sophos,firewall,auth-bypass,rce,kev,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/userportal/Controller?mode=8700&operation=1&datagrid=179&json={\"🦞\":\"test\"}"

    headers:
      X-Requested-With: "XMLHttpRequest"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{\"status\":\"Session Expired\"}"

      - type: word
        part: header
        words:
          - "Server: xxxx"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from