PT-2022-2444 · Sophos · Sophos Xg+1

Aryan Chehreghani

·

Published

2022-03-25

·

Updated

2026-03-04

·

CVE-2022-1040

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Sophos Firewall versions prior to v18.5 MR3 (18.5.3) Sophos XG Firewall version 17.0.10 MR-10
Description An authentication bypass issue exists in the User Portal and Webadmin components of Sophos Firewall, potentially allowing a remote attacker to execute code. The vulnerability allows bypassing authentication, granting unauthorized access to the firewall management interface. Reports indicate a significant surge in exploitation attempts, with a 435% increase observed recently. The vulnerability has been exploited in attacks involving the Pigmy Goat malware, a Linux rootkit used by Chinese threat actors. This malware leverages the vulnerability (CVE-2022-1040) to gain backdoor access to Sophos XG firewalls. The malware utilizes techniques like LD PRELOAD hijacking to intercept and manipulate SSH connections, establishing a command and control channel. The accept function within the SSH daemon is targeted for code execution. The vulnerability has also been linked to other threat actors and malware families, including NoodleRAT, AcidRain, and AcidPour. The exploitation involves sending a crafted POST request to the /userportal/Controller API Endpoint with a specific json parameter ({"x":"test"}). The vulnerability affects systems running Linux.
Recommendations Sophos Firewall versions prior to v18.5 MR3 (18.5.3) should be updated to a newer, secure version. Sophos XG Firewall version 17.0.10 MR-10 should be updated to a newer, secure version. As a temporary workaround, consider disabling the User Portal and Webadmin interfaces if they are not essential. Restrict access to the /userportal/Controller API Endpoint to minimize the risk of exploitation. Monitor network traffic for suspicious activity related to SSH connections and ICMP packets.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2022-02850
CVE-2022-1040

Affected Products

Sophos Firewall
Sophos Xg