CVE-2022-0386
📋 TL;DR
This is a post-authentication SQL injection vulnerability in Sophos UTM's Mail Manager component. An authenticated attacker could potentially execute arbitrary SQL commands, which may lead to remote code execution. Only Sophos UTM installations before version 9.710 are affected.
💻 Affected Systems
- Sophos UTM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Authenticated attacker gains full system compromise through SQL injection leading to remote code execution, potentially allowing data theft, lateral movement, or ransomware deployment.
Likely Case
Authenticated attacker extracts sensitive database information, modifies mail management configurations, or gains limited system access.
If Mitigated
With proper authentication controls and network segmentation, impact is limited to the mail management component only.
🎯 Exploit Status
Requires authenticated access to exploit. SQL injection could potentially lead to code execution in the context of the application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.710
Vendor Advisory: https://www.sophos.com/en-us/security-advisories/sophos-sa-20220321-utm-9710
Restart Required: Yes
Instructions:
1. Log into Sophos UTM web admin interface. 2. Navigate to System > Maintenance > Update. 3. Download and apply update to version 9.710 or later. 4. Reboot the system after update completes.
🔧 Temporary Workarounds
Disable Mail Manager
allTemporarily disable the Mail Manager component if not required
Restrict Access
allLimit access to Sophos UTM admin interface to trusted IP addresses only
🧯 If You Can't Patch
- Implement strict access controls to Sophos UTM admin interface
- Monitor for suspicious SQL queries in application logs
🔍 How to Verify
Check if Vulnerable:
Check Sophos UTM version in web admin interface under System > Status > System InformationCheck Version:
ssh admin@utm-ip 'cat /etc/version'Verify Fix Applied:
Confirm version is 9.710 or higher in System > Status > System Information📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in mail manager logs
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- Unusual database connections from UTM system
- SQL error messages in HTTP responses
SIEM Query:
source="sophos_utm" AND ("sql" OR "injection" OR "mail_manager")