PT-2017-10202 · Sophos · Sophos Web Appliance

Xort · Published 2017-01-28 · Updated 2017-03-08 · CVE-2016-9553

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sophos Web Appliance version 4.2.1.3

Description The issue affects the web administrative interface of the Sophos Web Appliance, specifically in the MgrReport.php component, which handles blocking and unblocking IP addresses. The problem arises from the improper escaping of information passed in the unblockip and blockip variables before they are used in the shell exec() function, allowing system commands to be injected. This occurs despite the variable name escapedips suggesting protection.

Recommendations For Sophos Web Appliance version 4.2.1.3, as a temporary workaround, consider restricting access to the MgrReport.php component, specifically the /controllers/MgrReport.php endpoint, to minimize the risk of exploitation. Avoid using the unblockip and blockip variables in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2016-9553

Affected Products

Sophos Web Appliance

References · 7

• 🔥 https://exploit-db.com/exploits/41413 · Exploit
• 🔥 http://pastebin.com/DUYuN0U5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-9553 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9553 · Vendor Advisory
• http://swa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.html · Note
• https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-version-4-3-1 · Note
• http://securityfocus.com/bid/95853 · Note