PT-2018-6610 · Sophos · Sophos Firewall

Published 2018-01-12 · Updated 2018-02-06 · CVE-2017-18014

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Sophos XG Firewall with SFOS versions prior to 17.0.3 MR3

Description: A persistent XSS issue was discovered in the Logging subsystem of Sophos XG Firewall. An unauthenticated user can trigger this issue in the WAF log page, located in the webadmin interface under Control Center -> Log Viewer, specifically in the filter option "Web Server Protection". The User-Agent parameter in the HTTP POST request is executed, allowing the execution of any action available to the webadmin of the firewall, such as creating a new user, enabling SSH, or adding an SSH authorized key.

Recommendations: For Sophos XG Firewall with SFOS versions prior to 17.0.3 MR3, update to version 17.0.3 MR3 or later to resolve the issue. As a temporary workaround, consider restricting access to the WAF log page in the webadmin interface to minimize the risk of exploitation. Avoid using the filter option "Web Server Protection" in the Log Viewer until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-18014

Affected Products

Sophos Firewall

References · 6

• 🔥 https://blogs.securiteam.com/index.php/archives/3612 · Exploit
• https://osv.dev/vulnerability/CVE-2017-18014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18014 · Security Note
• https://community.sophos.com/products/xg-firewall/b/xg-blog/posts/sfos-17-0-3-mr3-released · Vendor Advisory
• https://community.sophos.com/kb/en-us/128024 · Vendor Advisory
• http://seclists.org/fulldisclosure/2018/Jan/24 · Note