CVE-2023-1671
📋 TL;DR
CVE-2023-1671 is a critical pre-authentication command injection vulnerability in Sophos Web Appliance that allows unauthenticated attackers to execute arbitrary commands on affected systems. Organizations running Sophos Web Appliance versions older than 4.3.10.4 are affected. This vulnerability enables remote code execution with root privileges.
💻 Affected Systems
- Sophos Web Appliance
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install persistent backdoors, steal sensitive data, pivot to internal networks, and use the appliance as a foothold for further attacks.
Likely Case
Remote code execution leading to malware deployment, data exfiltration, or use as part of a botnet for DDoS attacks or cryptocurrency mining.
If Mitigated
Limited impact if appliance is isolated behind firewalls with strict network segmentation and egress filtering, though risk remains due to pre-auth nature.
🎯 Exploit Status
Public exploit code is available and actively used in attacks. CISA has added this to its Known Exploited Vulnerabilities catalog.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.10.4
Vendor Advisory: https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download Sophos Web Appliance 4.3.10.4 or later from Sophos support portal. 3. Apply the update through the admin interface. 4. Restart the appliance as prompted. 5. Verify successful update.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to Sophos Web Appliance management interface to trusted IP addresses only
Disable Warn-Proceed Handler
allIf possible, disable the vulnerable warn-proceed handler feature
🧯 If You Can't Patch
- Immediately isolate the appliance from internet access and restrict to internal trusted networks only
- Implement strict network segmentation and monitor all traffic to/from the appliance for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check the appliance version in the admin interface under System > Status > Software VersionCheck Version:
ssh admin@appliance-ip 'cat /etc/version' or check via web admin interfaceVerify Fix Applied:
Verify version is 4.3.10.4 or higher in the admin interface and check that all services are running normally after update📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed authentication attempts followed by successful access
- Suspicious process creation from web service
Network Indicators:
- Unusual outbound connections from appliance
- Traffic to known malicious IPs
- Unexpected SSH or reverse shell connections
SIEM Query:
source="sophos-web-appliance" AND (event_type="command_execution" OR process_name="sh" OR process_name="bash")🔗 References
- http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html
- https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
- http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html
- https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1671
