OS Command Injection in Sophos XG Firewall

1) OS Command Injection

EUVDB-ID: #VU45884

Risk: High

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-17352

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely execute arbitrary code.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Sophos Firewall: 17.5 - 18.0.2

CPE2.3

• cpe:2.3:h:sophos:xg_firewall:17.5:*:*:*:*:*:*:*
• cpe:2.3:h:sophos:xg_firewall:17.5.1:*:*:*:*:*:*:*
• cpe:2.3:h:sophos:xg_firewall:17.5.2:*:*:*:*:*:*:*
• cpe:2.3:h:sophos:xg_firewall:17.5.3:*:*:*:*:*:*:*
• cpe:2.3:h:sophos:xg_firewall:17.5.4:*:*:*:*:*:*:*
• cpe:2.3:h:sophos:xg_firewall:17.5.5:*:*:*:*:*:*:*
• cpe:2.3:h:sophos:xg_firewall:17.5.6:*:*:*:*:*:*:*
• cpe:2.3:h:sophos:xg_firewall:17.5.7:*:*:*:*:*:*:*
• cpe:2.3:h:sophos:xg_firewall:17.5.8:*:*:*:*:*:*:*
• cpe:2.3:h:sophos:xg_firewall:17.5.9:*:*:*:*:*:*:*

External links

https://community.sophos.com/b/security-blog/posts/advisory-resolved-authenticated-rce-issues-in-user-portal-cve-2020-17352
https://www.sophos.com/en-us/security-advisories/sophos-sa-20200807-xg-user-portal-post-auth-rce

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.