Is CVE-2016-9554 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-9554 being exploited in the wild.

How severe is CVE-2016-9554?

High severity, with a CVSS score of 7.2, published 28 January 2017.

Which products and versions are affected?

Sophos Web Appliance / Secure Web Gateway 4.2.1.3.

Is there a fix for CVE-2016-9554?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-9554 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-9554?

Check whether you run Sophos Web Appliance. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-9554: Sophos Web Appliance command injection in MgrDiagnosticTools.php

CVE-2016-9554 · Severity: high · CVSS 7.2 · Published 2017-01-28

The Sophos Web Appliance, a security tool used to protect corporate networks from web-based threats, contains a vulnerability in its administrative interface. An attacker with administrative access can exploit a flaw in the diagnostic tools to run unauthorized commands on the underlying server. This could lead to a complete takeover of the appliance, allowing the attacker to access sensitive data or disrupt network operations.

Technologies: Sophos Web Appliance. Vendors: Sophos.

Quick answers

Is CVE-2016-9554 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-9554 being exploited in the wild.
How severe is CVE-2016-9554?: High severity, with a CVSS score of 7.2, published 28 January 2017.
Which products and versions are affected?: Sophos Web Appliance / Secure Web Gateway 4.2.1.3.
Is there a fix for CVE-2016-9554?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-9554 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-9554?: Check whether you run Sophos Web Appliance. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A remote command injection vulnerability exists in the Sophos Web Appliance (version 4.2.1.3) within the MgrDiagnosticTools.php controller. The vulnerability is located in the component that performs diagnostic tests using the UNIX 'wget' utility. The application fails to properly sanitize or escape user-supplied input in the 'url' variable before passing it to the executeCommand function, which subsequently calls the PHP exec() function. An authenticated attacker with access to the administrative interface can exploit this by sending a crafted request to the 'configuration' section, resulting in arbitrary command execution with the privileges of the 'spiderman' user. This issue was addressed in version 4.3.1.

Affected products

Sophos Web Appliance / Secure Web Gateway 4.2.1.3

Timeline

2016-12-12: other: Exploit developed by researcher
2017-01-28: advisory: NVD published date
2017-02-22: other: Public exploit code released on Pastebin

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.