PT-2018-6610 · Sophos · Sophos Firewall

Publicado 2018-01-12 · Atualizado 2018-02-06 · CVE-2017-18014

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Sophos XG Firewall with SFOS versions prior to 17.0.3 MR3

Description: A persistent XSS issue was discovered in the Logging subsystem of Sophos XG Firewall. An unauthenticated user can trigger this issue in the WAF log page, located in the webadmin interface under Control Center -> Log Viewer, specifically in the filter option "Web Server Protection". The User-Agent parameter in the HTTP POST request is executed, allowing the execution of any action available to the webadmin of the firewall, such as creating a new user, enabling SSH, or adding an SSH authorized key.

Recommendations: For Sophos XG Firewall with SFOS versions prior to 17.0.3 MR3, update to version 17.0.3 MR3 or later to resolve the issue. As a temporary workaround, consider restricting access to the WAF log page in the webadmin interface to minimize the risk of exploitation. Avoid using the filter option "Web Server Protection" in the Log Viewer until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-18014

Produtos afetados

Sophos Firewall

Referências · 6

• 🔥 https://blogs.securiteam.com/index.php/archives/3612 · Exploit
• http://seclists.org/fulldisclosure/2018/Jan/24 · Nota
• https://osv.dev/vulnerability/CVE-2017-18014 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-18014 · Nota de Segurança
• https://community.sophos.com/products/xg-firewall/b/xg-blog/posts/sfos-17-0-3-mr3-released · Aviso do Fabricante
• https://community.sophos.com/kb/en-us/128024 · Aviso do Fabricante