Executive brief
The Sophos Web Appliance, a security tool used to protect corporate networks from web-based threats, contains a vulnerability in its administrative interface. An attacker with administrative access can exploit a flaw in the diagnostic tools to run unauthorized commands on the underlying server. This could lead to a complete takeover of the appliance, allowing the attacker to access sensitive data or disrupt network operations.
Technical details
A remote command injection vulnerability exists in the Sophos Web Appliance (version 4.2.1.3) within the MgrDiagnosticTools.php controller. The vulnerability is located in the component that performs diagnostic tests using the UNIX 'wget' utility. The application fails to properly sanitize or escape user-supplied input in the 'url' variable before passing it to the executeCommand function, which subsequently calls the PHP exec() function. An authenticated attacker with access to the administrative interface can exploit this by sending a crafted request to the 'configuration' section, resulting in arbitrary command execution with the privileges of the 'spiderman' user. This issue was addressed in version 4.3.1.
Affected products
- Sophos Web Appliance / Secure Web Gateway 4.2.1.3
Timeline
- 2016-12-12: other: Exploit developed by researcher
- 2017-01-28: advisory: NVD published date
- 2017-02-22: other: Public exploit code released on Pastebin