CVE-2023-47091
📋 TL;DR
This vulnerability in Stormshield Network Security (SNS) firewalls allows attackers to overflow the cookie threshold, preventing IPsec connections from being established. It affects SNS versions 4.3.13-4.3.22, 4.6.0-4.6.9, and 4.7.0-4.7.1. Organizations using these versions for VPN connectivity are at risk.
💻 Affected Systems
- Stormshield Network Security (SNS)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of IPsec VPN services, disrupting remote access and site-to-site connectivity for extended periods.
Likely Case
Targeted IPsec connection failures affecting specific VPN tunnels or remote users.
If Mitigated
Limited impact with redundant VPN paths or alternative connectivity methods available.
🎯 Exploit Status
The vulnerability requires network access to IPsec endpoints but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SNS 4.3.23, SNS 4.6.10, SNS 4.7.2
Vendor Advisory: https://advisories.stormshield.eu/2023-024/
Restart Required: Yes
Instructions:
1. Download the appropriate firmware update from Stormshield support portal. 2. Backup current configuration. 3. Apply the firmware update via web interface or CLI. 4. Reboot the firewall. 5. Verify VPN connectivity is restored.
🔧 Temporary Workarounds
Rate limit IPsec connections
allConfigure connection rate limiting to prevent cookie threshold overflow
# Configure via Stormshield CLI or web interface
# Set maximum concurrent IPsec connections per source IP
Temporary VPN alternative
allUse SSL VPN or alternative remote access methods while patching
# Enable SSL VPN if available
# Configure alternative access methods
🧯 If You Can't Patch
- Implement network-level rate limiting for IPsec traffic using upstream firewalls or IPS devices
- Monitor IPsec connection attempts and block suspicious source IPs showing excessive connection attempts
🔍 How to Verify
Check if Vulnerable:
Check SNS firmware version via web interface (System > Information) or CLI command 'show version'Check Version:
show versionVerify Fix Applied:
Verify firmware version is 4.3.23, 4.6.10, or 4.7.2 or higher, then test IPsec connectivity📡 Detection & Monitoring
Log Indicators:
- Multiple IPsec connection failures from single source IP
- Cookie threshold exceeded messages in firewall logs
- IPsec tunnel establishment failures
Network Indicators:
- Excessive IKE/ISAKMP packets from single source
- Failed IPsec phase 1 negotiations
- Spike in UDP port 500/4500 traffic
SIEM Query:
source="stormshield-firewall" ("cookie threshold" OR "IPsec failure" OR "IKE failure") | stats count by src_ip