Black Arrow Cyber Advisory – Critical SonicWall VPN Bug Allows Remote Unauthenticated Takeover
Black Arrow Cyber Advisory – Critical SonicWall VPN Bug Allows Remote Unauthenticated Takeover
Executive Summary
SonicWall, a security vendor best known for their hardware appliances, is the subject of a critical advisory relating to its Secure Mobile Access (SMA) 100 series VPN appliances. The SMA 100 series provides secured end-to-end remote access to corporate networks and resources in a variety of environments, such as on-premises, hybrid or cloud infrastructure. The SMA 100 also provides policy driven access control, based on trusted users and devices.
The bug, rated a 9.8 out of 10 on the CVSS scale, allows a remote attacker to authenticate as “nobody”, effectively granting them the lowest level of access to the device. As such, an attacker would be able to modify policies, alter security settings or launch additional attacks from the compromised device.
What’s the risk to my business?
If you or your IT provider use the SonicWall SMA 100 appliance, the risk could be high. CVSS scores of 9.0 and higher carry a “fix immediately” flag, as any attack capable of remote execution provides an attractive target to bad actors. As firewalls and other perimeter security devices generally form the first line of defence, and protect a huge quantity of assets, compromising one can facilitate any number of additional attacks.
What can I do?
Speak to your IT service provider or IT team to find out if the SMA 100 is used in your environment. SonicWall have urged users to patch and continue to patch their devices, as SonicWall have been the subject of numerous attacks in recent years.
Technical Summary
The vulnerability – CVE-2021-20038 – has been found in the string concatenate function strcat(), which is used when handling environment variables in a HTTP GET method. The bug runs under the Apache httpd server, allowing attackers to run a stack-based buffer overflow to result in code execution.
A complete list of impacted devices can be found on SonicWall’s website.
Need help understanding your gaps, or just want some advice? Get in touch with us.