CVE-2016-9554 Command injection in n/a
Remote attackers can execute arbitrary commands on the Sophos Web Appliance via unsanitized input in the diagnostic tools interface.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-9554?
CVE-2016-9554 is a high-severity command injection vulnerability in n/a, published on 28 Jan 2017. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. These vulnerabilities occur in MgrDiagnosticTools.php (/controllers/MgrDiagnosticTools.php), in the component responsible for performing diagnostic tests with the UNIX wget utility. The application doesn't properly escape the information passed in the 'url' variable before calling the executeCommand class function ($this->dtObj->executeCommand). This function calls exec() with unsanitized user input allowing for remote command injection. The page that contains the vulnerabilities, /controllers/MgrDiagnosticTools.php, is accessed by a built-in command answered by the administrative interface. The command that calls to that vulnerable page (passed in the 'section' parameter) is: 'configuration'. Exploitation of this vulnerability yields shell access to the remote machine under the 'spiderman' user account.
Weakness: CWE-77
Which versions are affected by CVE-2016-9554?
It affects 1 product.
Products include Sophos Web Appliance.
How do I fix CVE-2016-9554?
No fix has been published for CVE-2016-9554 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-9554 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-9554 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h9p6-824j-f26j.