#VU52377 Path traversal in SonicWall On-premise Email Security (ES) and SonicWall Hosted Email Security (HES) - CVE-2021-20023
Published: April 20, 2021 / Updated: April 21, 2021
Vulnerability identifier: #VU52377
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2021-20023
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
SonicWall On-premise Email Security (ES)
SonicWall Hosted Email Security (HES)
SonicWall On-premise Email Security (ES)
SonicWall Hosted Email Security (HES)
Software vendor:
SonicWall
SonicWall
Description
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences within the "branding" feature. A remote authenticated user can send a specially crafted HTTP request and read arbitrary files on the system with NT AUTHORITY\SYSTEM account.
Request example:
https://<SonicWall ES host>/dload_apps?action=<any value>&path=..%2F..%2F..%2F..%2F..%2Fwindows%2Fsystem32%2Fcalc.exe&id=update
Note, the vulnerability is being actively exploited in the wild.
Remediation
Install update from vendor's website.