CVE-2020-15504
📋 TL;DR
This SQL injection vulnerability in Sophos XG Firewall allows attackers to execute arbitrary SQL commands through the user and admin web interfaces. Successful exploitation can lead to remote code execution, potentially compromising the entire firewall system. Organizations running Sophos XG Firewall v18.0 MR1 or older versions are affected.
💻 Affected Systems
- Sophos XG Firewall
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete firewall compromise leading to network infiltration, data exfiltration, and use as pivot point for internal attacks
Likely Case
Firewall configuration manipulation, credential theft, and installation of persistent backdoors
If Mitigated
Limited to SQL injection attempts that are blocked by input validation and WAF rules
🎯 Exploit Status
Exploitation requires authentication to either user or admin interface. SQL injection leads to RCE through firewall's underlying components.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v18 MR-1-Build396 or v17.5 MR13
Vendor Advisory: https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-via-sqli-cve-2020-15504
Restart Required: Yes
Instructions:
1. Log into Sophos Central or local management console. 2. Check current firmware version. 3. Download and apply v18 MR-1-Build396 or v17.5 MR13. 4. Reboot firewall after update completes. 5. Verify update in System > Administration > Firmware.
🔧 Temporary Workarounds
Restrict Web Interface Access
allLimit access to firewall web interfaces to trusted IP addresses only
Configure firewall rules to restrict access to TCP ports 4444 (admin) and 443 (user) to specific management IPs
Enable WAF/IPS Protection
allActivate SQL injection detection rules in firewall's web application protection
Navigate to Protect > Web > Web Server Protection and enable SQL injection rules
🧯 If You Can't Patch
- Implement strict network segmentation to isolate firewall management interfaces
- Enable multi-factor authentication for all admin and user accounts
🔍 How to Verify
Check if Vulnerable:
Check firmware version in System > Administration > Firmware. If version is v18.0 MR1 or older and not patched, system is vulnerable.Check Version:
ssh admin@firewall_ip 'show system version' or check via web interfaceVerify Fix Applied:
Verify firmware version shows v18 MR-1-Build396 or v17.5 MR13 or later in System > Administration > Firmware📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in web interface logs
- Multiple failed login attempts followed by successful login
- Unexpected configuration changes
Network Indicators:
- SQL injection patterns in HTTP requests to firewall web interfaces
- Unusual outbound connections from firewall
SIEM Query:
source="sophos_firewall" AND (http_uri="*SELECT*" OR http_uri="*UNION*" OR http_uri="*INSERT*" OR http_uri="*DELETE*")