PT-2019-9222 · Sophos · Sophos Firewall

Published 2019-06-20 · Updated 2019-06-25 · CVE-2018-16118

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sophos XG firewall version 17.0.8 MR-8

Description A shell escape issue in the API Configuration component allows remote attackers to execute arbitrary OS commands. This is achieved by injecting shell metacharacters into the X-Forwarded-for HTTP header in the /webconsole/APIController API endpoint.

Recommendations For Sophos XG firewall version 17.0.8 MR-8, consider restricting access to the /webconsole/APIController API endpoint until a patch is available. As a temporary workaround, avoid using the X-Forwarded-for HTTP header in this endpoint to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-16118

Affected Products

Sophos Firewall

References · 5

• https://github.com/klsecservices/Advisories/blob/master/KL-SOPHOS-2018-003.md · Patch
• https://community.sophos.com/kb/en-us/132637 · Vendor Advisory
• https://sophos.com/en-us/legal/sophos-responsible-disclosure-policy.aspx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16118 · Security Note