Dealer Threat Advisory 18-21: Buffer Overflow in HTTP Request Header Leads to Partial Memory Leak (SonicWall)

THREAT UPDATE

On June 23, security researchers reported that SonicWall’s stack-based Buffer Overflow vulnerability from late last year was only partially patched, yielding another attack vector for unpatched systems. A threat actor can send malicious requests to the firewall to execute code remotely and gain a foothold into an unpatched environment through partial memory leaks. rocketwise recommends patching all affected SonicWall VPN appliances as soon as possible.

TECHNICAL DETAIL & ADDITIONAL INFORMATION

WHAT IS THE THREAT?

SonicWall VPN appliances had a critical vulnerability (CVE-2020-5135) in October of last year that delineated a stack-based Buffer Overflow. On June 23, a new critical vulnerability was identified that is tangent to the October vulnerability as researchers realized that the vulnerability from last year was only partially patched. Identified as CVE-2021-20019, Sonic’s team reported that “SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.”

WHY IS IT NOTEWORTHY?

All critical vulnerabilities that allow a threat actor to execute arbitrary code should be taken very seriously. Left unpatched, a threat actor could gain an initial foothold on your environment that could lead to lateral movement, persistence, and privilege escalation. The vulnerability resides in the web service used for VPN systems and product management. The exploits Proof-of-Concept details an unauthenticated HTTP request with custom protocols.

WHAT IS THE EXPOSURE OR RISK?

As reported by SonicWall in their advisory, this exploit “affects SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.” Left unpatched, an attacker can send these malicious HTTP/HTTPS custom protocol requests to your firewall environment to gain access to your systems.

WHAT ARE THE RECOMMENDATIONS?

rocketwise recommends to patch any vulnerable SonicWall platforms as soon as possible. Please view the following tables for the patch releases for specific SonicOS platforms:

REFERENCES

For more in-depth information about the recommendations, please visit the following links:

• https://securityaffairs.co/wordpress/119269/security/sonicwall-vpn-unpatched-flaw.html
• https://securityaffairs.co/wordpress/109560/hacking/sonicwall-cve-2020-5135-flaw.html
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0006

If you have any questions, please contact us.