CVE-2021-36807
📋 TL;DR
An authenticated user can execute arbitrary code through an SQL injection vulnerability in the Sophos SG UTM user portal. This affects organizations running SG UTM versions before 9.708 MR8, potentially compromising the security appliance.
💻 Affected Systems
- Sophos SG UTM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary code, access sensitive data, and pivot to internal networks.
Likely Case
Data exfiltration, privilege escalation, or manipulation of UTM configurations leading to further attacks.
If Mitigated
Limited impact if strong authentication, network segmentation, and input validation are in place, but risk remains.
🎯 Exploit Status
Exploitation requires authenticated access; SQL injection is a common attack vector with low complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.708 MR8 or later
Vendor Advisory: https://www.sophos.com/en-us/security-advisories/sophos-sa-20211126-sg-sqli
Restart Required: Yes
Instructions:
1. Log into the SG UTM admin interface. 2. Navigate to System > Update. 3. Check for and apply the update to version 9.708 MR8 or higher. 4. Restart the system as prompted.
🔧 Temporary Workarounds
Disable User Portal
allTemporarily disable the vulnerable user portal to prevent exploitation.
Log into admin interface, go to Web > User Portal, and disable it.
Restrict Access
allLimit network access to the user portal using firewall rules to trusted IPs only.
Configure firewall rules in SG UTM to allow only specific IPs to access the user portal.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the SG UTM from critical systems.
- Enforce strong authentication and monitor for unusual SQL queries in logs.
🔍 How to Verify
Check if Vulnerable:
Check the SG UTM version via the admin interface; if below 9.708 MR8, it is vulnerable.Check Version:
Log into the admin web interface and navigate to System > Update to view the current version.Verify Fix Applied:
After patching, confirm the version is 9.708 MR8 or higher in the System > Update section.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in user portal logs, unexpected authentication attempts, or error messages related to SQL injection.
Network Indicators:
- Suspicious HTTP POST requests to user portal endpoints with SQL payloads.
SIEM Query:
Example: search for 'user_portal' AND ('sql' OR 'injection') in web server logs.