id: CVE-2022-1040 info: name: Sophos Firewall <=18.5 MR3 - Remote Code Execution author: For3stCo1d severity: critical description: | Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code. remediation: | Upgrade to a patched version of Sophos Firewall (>=18.5 MR4) to mitigate this vulnerability. reference: - https://github.com/killvxk/CVE-2022-1040 - https://github.com/CronUp/Vulnerabilidades/blob/main/CVE-2022-1040_checker - https://nvd.nist.gov/vuln/detail/CVE-2022-1040 - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-1040 cwe-id: CWE-287 epss-score: 0.97072 epss-percentile: 0.99689 cpe: cpe:2.3:o:sophos:sfos:*:*:*:*:*:*:*:* metadata: verified: true max-request: 1 vendor: sophos product: sfos shodan-query: http.title:"Sophos" tags: cve,cve2022,sophos,firewall,auth-bypass,rce,kev http: - method: POST path: - "{{BaseURL}}/userportal/Controller?mode=8700&operation=1&datagrid=179&json={\"🦞\":\"test\"}" headers: X-Requested-With: "XMLHttpRequest" matchers-condition: and matchers: - type: word part: body words: - "{\"status\":\"Session Expired\"}" - type: word part: header words: - "Server: xxxx" - type: status status: - 200 # digest: 490a0046304402206f4a66cf27b4d7f027a257b710011b9d282d7fb38184ba7c1606340e1ed112b302205adffa170935dd1a74f7c560052ba527b498429aad5cdf7e8beca49e9765ccd5:922c64590222798bb761d5b6d8e72950