SONICWALL SMA 100 SERIES COULD ALLOW FOR SQL INJECTION

Fortify Security Team
Feb 24, 2021

A vulnerability has been discovered in the SonicWall SMA 100 Series, which could allow for SQL injection. The SonicWall SMA 100 Series is a unified secure access gateway that enables organizations to provide access to any application, anytime, from anywhere and any devices, including managed and unmanaged. Successful exploitation of this vulnerability could result in SQL injection, which enables the retrieval of admin credentials. Afterwards, this retrieval can pivot into a remote-code execution attack. Depending on the privileges associated with the application, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights.

February 23 – UPDATED OVERVIEW:

SonicWall conducted additional reviews to further strengthen the code for the SMA 100 series. New firmware versions available for both 10.x and 9.x code on the SMA 100 series products.

THREAT INTELLIGENCE:

There are currently reports of this vulnerability being exploited in the wild as per NCCGroup.

SYSTEMS AFFECTED:

  • SonicWall SMA 200, SMA 210, SMA 400, SMA 410
  • SonicWall SMA 500v (Azure, AWS, ESXi, HyperV)

RISK:

Government:

  • Large and medium government entities: High
  • Small government entities: High

Businesses:

  • Large and medium business entities: High
  • Small business entities: High

Home users: Low

TECHNICAL SUMMARY:

A vulnerability has been discovered in the SonicWall SMA 100 Series, which could allow for SQL injection. The improper SQL command neutralization in the SonicWall SSLVPN SMA100 product enables the execution of SQL commands of the attacker’s choosing.

Successful exploitation of this vulnerability could result in SQL injection, which enables the retrieval of admin credentials. Afterwards, this retrieval can pivot into a remote-code execution attack. Depending on the privileges associated with the application, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights.

February 23 – UPDATED TECHNICAL SUMMARY:

SonicWall conducted additional reviews to further strengthen the code for the SMA 100 series. New firmware versions available for both 10.x and 9.x code on the SMA 100 series products.

The new SMA 10.2 firmware includes:

  • Code-hardening fixes identified during an internal code audit
  • Rollup of customer issue fixes not included in the Feb. 3 patch
  • General performance enhancements
  • Previous SMA 100 series zero-day fixes posted on Feb. 3

The new 9.0 firmware includes:

  • Code-hardening fixes identified during an internal code audit

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Apply the patched version of the SMA 10.x firmware to vulnerable systems immediately after appropriate testing.
  • Apply appropriate countermeasures recommended by SonicWall within their advisory
  • Apply the Principle of Least Privilege to all systems and services.

February 23 – UPDATED RECOMMENDATIONS:

We recommend the following actions be taken:

  • Apply the patched versions of SMA 10.x or 9.x firmware to vulnerable systems immediately after appropriate testing.

REFERENCES:

SonicWall:

https://www.sonicwall.com/support/product-notification/urgent-patch-available-for-sma-100-series-10-x-firmware-zero-day-vulnerability-updated-feb-3-2-p-m-cst/210122173415410/

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001

NCCGroup:

https://twitter.com/NCCGroupInfosec/status/1355850304596680705

February 23 – UPDATED REFERENCES:

SonicWall:

https://www.sonicwall.com/support/product-notification/additional-sma-100-series-10-x-and-9-x-firmware-updates-required-updated-feb-19-2-p-m-cst/210122173415410/

Recent Posts

Mozilla Firefox Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Mozilla Firefox and Firefox Extended Support Release (ESR), the most severe of which could allow for arbitrary code execution. Mozilla Firefox is a web browser used to access the Internet. Mozilla Firefox ESR is a...

Google Chrome Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe of these vulnerabilities could...

Apple Products Vulnerable to Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Apple Products, the most severe of which could allow for arbitrary code execution. iOS is a mobile operating system for mobile devices, including the iPhone, iPad, and iPod touch. iPadOS is the successor to iOS 12 and...

Indicators of Compromise Associated with Hive Ransomware

Hive ransomware, which was first observed in June 2021 and likely operates as an affiliate-based ransomware, employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Hive ransomware uses multiple...

Critical Patches Issued for Microsoft Products, May 11, 2021

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs;...