This repository provides a fully functional PoC that automates the entire exploit chain – from WebSocket handshake to arbitrary command execution – with a clean interface, advanced error handling, and beautiful logging.

🔍 Key Features

• WebSocket tunneling – works directly over wss:// using the wsproxy endpoint.
• Erlang distribution protocol – fully implements the handshake and ETF (Erlang External Term Format).
• Remote code execution – via os:cmd/1; can read files via file:read_file/1 or test connectivity with erlang:node/0.
• Intelligent detection – supports arbitrary bmID values (as long as they start with -3389) and multiple serviceType values.
• Comprehensive logging – color‑coded messages with [+], [*], [-], [!] symbols for easy monitoring.

🧬 Vulnerability Details

The vulnerability stems from the following design weaknesses in the SMA 1000:

1. Unrestricted WebSocket proxying – The /wsproxy endpoint forwards binary WebSocket messages to a local Erlang distribution port (localhost:1050 by default) without proper authentication or authorisation.
2. Predictable/hardcoded Erlang cookie – The cookie used for distribution authentication is static across all SMA appliances (at least in the tested version). This allows an external attacker to complete the handshake.
3. Exposed Erlang node – The Erlang node [email protected] listens on 1050 and accepts connections from the WebSocket proxy, making it reachable from the network.
4. Powerful RPC interface – The Erlang node offers the standard rex service, which can execute arbitrary functions on the node, including os:cmd/1.

Affected Versions

• SonicWall SMA 1000 series with firmware prior to the June 2026 hotfix (e.g., ex_sra_vm_12.5.0-02002.ova).
• The WorkPlace service must be enabled (default configuration).

Impact

• Remote Code Execution as the couchdb user (UID 1010, group daemon).
• Lateral movement – an attacker can leverage CVE-2026-15410 (XML‑RPC path traversal) to escalate privileges to root.
• Data exfiltration – read arbitrary files via file:read_file/1.
• Persistence – install backdoors or modify system files.

🔧 Exploitation Requirements

• Network access to the SMA appliance’s WorkPlace service (usually TCP/443).
• No valid credentials are required – the exploit works unauthenticated.
• Python 3.8+ with the websockets library (install via pip install websockets).

🚀 Usage

Installation

Basic Command

Example Output

Advanced Options

🧪 Technical Details for Detection & Tuning

Hardcoded Cookie

The Erlang cookie used in the exploit is:

This value is consistent across all tested SMA appliances and is hardcoded in the Erlang process on localhost:1050. It is not the same as the user‑configured cookie for clustering.

The bmID Parameter

The bmID must start with -3389 (e.g., -3389c1b25ccd). Arbitrary values after the prefix are accepted, so signature‑based detection should not rely on a fixed hash.

Service Types

While the example uses serviceType=SSH, other values such as TELNET also work. The exploit is agnostic to the service type.

Port Selection

Port 1050 is the default internal port, but in‑the‑wild attacks have been observed targeting port 8188 as well. The exploit can be adapted to any port that exposes the Erlang distribution protocol.

Privilege Escalation

After gaining a shell as couchdb, an attacker can leverage CVE-2026-15410 – an XML‑RPC path traversal that allows removal of the hotfix and subsequent root privilege escalation.

🛡️ Detection & Mitigation

Indicators of Compromise (IoCs)

• Unusual WebSocket connections to /wsproxy with bmID starting with -3389.
• Unexpected outbound connections from the SMA appliance to external IPs.
• Processes spawned by the couchdb user (e.g., bash, python, nc).
• Modification or creation of files in /var/tmp/ by the couchdb user.

Recommended Actions

1. Apply the official patch from SonicWall (June 2026 hotfix) immediately.
2. Restrict access to the WorkPlace service to trusted IP ranges only.
3. Monitor logs for anomalous WebSocket activity and Erlang distribution attempts.
4. Change the Erlang cookie for the internal Erlang node (if possible) – though this may affect application functionality.
5. Disable the WorkPlace service if not required.

👏 Credits

• discovery & PoC: Ch4120N.
• Additional research: SonicWall PSIRT and the broader security community.

📄 License

This project is licensed under the MIT License – see the LICENSE file for details.

Disclaimer: This tool is for educational and authorised testing purposes only. The author and contributors are not responsible for any misuse or damage caused by this software.

📚 References

• SonicWall Security Advisory (CVE-2026-15409)
• NIST NVD Entry – CVE-2026-15409

⭐ Support

If you find this PoC useful, please consider giving it a ⭐ on GitHub and sharing it responsibly. Contributions, issues, and pull requests are welcome!

Happy hacking! 🛡️