Hackers are exploiting a Sophos firewall zero-day

guest · Apr 26, 2020

Hackers are exploiting a Sophos firewall zero-day
Sophos releases emergency patch to fix SQL injection bug exploited in the wild, impacting its XG Firewall product
April 26, 2020
https://www.zdnet.com/article/hackers-are-exploiting-a-sophos-firewall-zero-day/

Cyber-security firm Sophos has published an emergency security update on Saturday to patch a zero-day vulnerability in its XG enterprise firewall product that was being abused in the wild by hackers.

Sophos said it first learned of the zero-day on late Wednesday, April 22, after it received a report from one of its customers. The customer reported seeing "a suspicious field value visible in the management interface."
After investigating the report, Sophos determined this was an active attack and not an error in its product.
Click to expand...

HACKERS ABUSED AN SQL INJECTION BUG TO STEAL PASSWORDS
"The attack used a previously unknown SQL injection vulnerability to gain access to exposed XG devices," Sophos said in a security advisory today.

Hackers targeted Sophos XG Firewall devices that had their administration (HTTPS service) or the User Portal control panel exposed on the internet.
Sophos said the hackers used the SQL injection vulnerability to download a payload on the device. This payload then stole files from the XG Firewall.
Click to expand...

PATCH ALREADY PUSHED TO CUSTOMER DEVICES
The UK company, famed for its antivirus product, said it prepared and already pushed an automatic update to patch all XG Firewalls that have the auto-update feature enabled.

"This hotfix eliminated the SQL injection vulnerability which prevented further exploitation, stopped the XG Firewall from accessing any attacker infrastructure, and cleaned up any remnants from the attack," it said.
Sophos also recommends that companies disable the firewall's administration interfaces on the internet-facing ports if they don't need the feature. Instructions to disable the control panel on the WAN interface are available here.
Click to expand...

Minimalist · May 21, 2020

Hackers tried to use Sophos Firewall zero-day to deploy Ransomware

Hackers tried to exploit a zero-day in the Sophos XG firewall to distribute ransomware to Windows machines but were blocked by a hotfix issued by Sophos.
Click to expand...

https://www.bleepingcomputer.com/ne...ophos-firewall-zero-day-to-deploy-ransomware/

guest · Jul 18, 2020

Further security holes poked and plugged in Sophos XG firewalls
July 16, 2020
https://portswigger.net/daily-swig/further-security-holes-poked-and-plugged-in-sophos-xg-firewalls

Security researchers investigating the impact of a patched security vulnerability in Sophos XG firewalls managed to discover a similar flaw that posed a remote code execution (RCE) risk.
SQLi to RCE
Sophos initially categorized the vulnerability as principally posing an SQL injection (SQLi) risk, but that might be understating the problem.
German security consultancy Code White began looking at the vulnerability tracked as CVE-2020-12271, which was patched in April shortly after it was exploited to distribute the Asnarök trojan.

“Our analysis not only resulted in a working RCE exploit for the disclosed vulnerability (CVE-2020-12271), but also led to the discovery of another SQLi, which could have been used to gain code execution (CVE-2020-15504),” Code White explains in a detailed technical blog post.
Click to expand...

Sophos acted promptly to develop and release a hotfix in May, before releasing updated firmware that bundled the fix in June and July.
Sophos told The Daily Swig that there was no evidence the flaw the German security consultancy had uncovered had been exploited in the wild.

Elze added that Sophos’ automated update mechanism meant that most users would be protected.

“In general, the automatic hotfix feature of Sophos XG Firewalls seems to be a very nice way to make sure that critical security patches are deployed very quickly which is something we do not see that often in other products,” he said.
Click to expand...

guest · Jan 17, 2023

Over 4,000 Sophos Firewall devices vulnerable to RCE attacks
By Sergiu Gatlan @serghei - January 17, 2023

Over 4,000 Sophos Firewall devices exposed to Internet access are vulnerable to attacks targeting a critical remote code execution (RCE) vulnerability.
Click to expand...

Sophos disclosed this code injection flaw (CVE-2022-3236) found in the User Portal and Webadmin of Sophos Firewall in September and also released hotfixes for multiple Sophos Firewall versions (official fixes were issued three months later, in December 2022).

The company warned at the time that the RCE bug was being exploited in the wild in attacks against organizations from South Asia.
Click to expand...

Thousands of devices are still vulnerable
While scanning the Internet for Sophos Firewall devices, VulnCheck vulnerability researcher Jacob Baines found that out of more than 88,000 instances, around 6% or more than 4,000 are running versions that haven't received a hotfix and are vulnerable to CVE-2022-3236 attacks.

"More than 99% of internet-facing Sophos Firewalls haven't upgraded to versions containing the official fix for CVE-2022-3236," Baines said.
"But around 93% are running versions that are eligible for a hotfix, and the default behavior for the firewall is to automatically download and apply hotfixes (unless disabled by an administrator).
Click to expand...

Luckily, despite already being exploited as a zero-day, a CVE-2022-3236 proof-of-concept exploit is yet to be published online.
Click to expand...

VulnCheck: Assessing Potential Exploitation of Sophos Firewall and CVE-2022-3236

By Jacob Baines @Junior_Baines - January 13, 2023
Key Takeaways

As there are no public proof-of-concept exploits for CVE-2022-3236, we created our own to determine its potential for mass exploitation.

We scanned internet-facing Sophos Firewalls and found more than 4,000 firewalls that were too old to receive a hotfix.

We encourage Sophos Firewall administrators to look through their logs to determine if they see indications of exploit attempts. Two files to focus on include /logs/csc.log and /log/validationError.log.

Internet-facing firewalls appear to largely be eligible for hotfixes and the default authentication captcha likely prevented mass exploitation.

Click to expand...

Log in or Sign up

Hackers are exploiting a Sophos firewall zero-day

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Log in or Sign up

Hackers are exploiting a Sophos firewall zero-day

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Useful Searches