PT-2023-2510 · Sophos · Sophos Web Appliance

Published 2023-04-04 · Updated 2025-03-13 · CVE-2023-1671

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sophos Web Appliance versions prior to 4.3.10.4

Description The issue is related to a lack of input sanitization in the warn-proceed handler component of Sophos Web Appliance, which can be exploited by a remote attacker to execute arbitrary commands. This is a pre-auth command injection vulnerability, allowing for the execution of arbitrary code.

Recommendations For versions prior to 4.3.10.4, update to version 4.3.10.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the warn-proceed handler to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-02307

CVE-2023-1671

Affected Products

Sophos Web Appliance

References · 24

• 🔥 https://github.com/W01fh4cker/CVE-2023-1671-POC · Exploit
• 🔥 https://github.com/ohnonoyesyes/CVE-2023-1671 · Exploit
• 🔥 https://exploit-db.com/exploits/51396 · Exploit
• 🔥 http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-1671 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1671 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02307 · Security Note
• https://t.me/pentestingnews/34693 · Telegram Post
• https://sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce · Vendor Advisory, Security Note
• https://t.me/pentestingnews/41187 · Telegram Post
• https://vuldb.com/ru/?id.224856 · Note
• https://t.me/proxy_bar/1463 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1671 · Note
• https://t.me/pentestingnews/35335 · Telegram Post
• https://t.me/cybersecuritytechnologies/8177 · Telegram Post