Sophos Firewall User Portal / Webadmin Auth Bypass RCE
- Product
- Sophos Sophos Firewall (SFOS)
- CVE
- CVE-2022-1040
- Disclosed
- 2022-03-25
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Sophos Firewall v18.5 MR3 (18.5.3) and older.
- Fixed
- Hotfix for supported versions; v19.0 GA, v18.5 MR4, v18.0 MR6/MR5-1.
Summary
An authentication bypass in the Sophos Firewall User Portal and Webadmin allowed unauthenticated remote code execution. Volexity documented a Chinese APT (DriftingCloud) exploiting it as a zero-day to hijack DNS and target websites in South Asia.
Root cause
Requests to the User Portal/Webadmin controller are parsed by a Java front end and then a Perl back end. Inconsistencies in how the two layers interpret the same request let an unauthenticated user reach privileged functions intended only for authenticated administrators, leading to command execution.
Impact
Unauthenticated code execution on the firewall, enabling traffic manipulation and pivoting.
Detection
Check that the hotfix is applied (auto-update) and review for unexpected webshells or admin changes.
Mitigation
Apply hotfix/upgrade and disable WAN access to User Portal and Webadmin.