PT-2023-6171 · Sangfor · Sangfor Next-Gen Application Firewall
Sonny
+1
·
Publicado
2023-10-10
·
Atualizado
2025-11-28
·
CVE-2023-30803
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Sangfor Next-Gen Application Firewall version NGAF8.0.17
Description
The issue allows a remote and unauthenticated attacker to bypass authentication and access administrative functionality. This is achieved by sending HTTP requests with a crafted
Y-forwarded-for header. The vulnerability is related to an authentication bypass, which can be exploited using specially formed HTTP requests.Recommendations
For Sangfor Next-Gen Application Firewall version NGAF8.0.17, consider restricting access to administrative functionality until a patch is available. As a temporary workaround, avoid using the
Y-forwarded-for header in HTTP requests to minimize the risk of exploitation.Exploit
Correção
Authentication Bypass by Spoofing
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Sangfor Next-Gen Application Firewall