PT-2019-9222 · Sophos · Sophos Firewall

Publicado 2019-06-20 · Atualizado 2019-06-25 · CVE-2018-16118

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sophos XG firewall version 17.0.8 MR-8

Description A shell escape issue in the API Configuration component allows remote attackers to execute arbitrary OS commands. This is achieved by injecting shell metacharacters into the X-Forwarded-for HTTP header in the /webconsole/APIController API endpoint.

Recommendations For Sophos XG firewall version 17.0.8 MR-8, consider restricting access to the /webconsole/APIController API endpoint until a patch is available. As a temporary workaround, avoid using the X-Forwarded-for HTTP header in this endpoint to minimize the risk of exploitation.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-16118

Produtos afetados

Sophos Firewall

Referências · 5

• https://github.com/klsecservices/Advisories/blob/master/KL-SOPHOS-2018-003.md · Correção
• https://community.sophos.com/kb/en-us/132637 · Aviso do Fabricante
• https://sophos.com/en-us/legal/sophos-responsible-disclosure-policy.aspx · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-16118 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16118 · Nota de Segurança