Cybersecurity Threat Advisory 0044-22: SonicWall critical vulnerability
SonicWall has recently addressed the critical vulnerability, CVE-2022-22280, that has a severity rating of 9.4. This vulnerability impacts SonicWall Global Management System (GMS) and its Analytics On-Prem. Upon exploit, the vulnerability allows malicious actors to perform unauthenticated SQL injection due to improper neutralization of special elements used in an SQL Command. SonicWall PSIRT is not aware of active exploitation in the wild or any public proof of concept (PoC).
Technical Detail & Additional Information
WHAT IS THE THREAT?
The CVE-2002-22280 vulnerability impacts SonicWall GMS 9.3.1-SP2-Hotfix-1 and earlier, as well as Analytics On-Prem 18.104.22.168-2520 and earlier. This vulnerability allows malicious actors to bypass authentication to alter SQL commands as it does not neutralize or incorrectly neutralizes special elements that can be interpreted as control elements or syntactic markers when they are sent to a downstream component.
WHY IS IT NOTEWORTHY?
SonicWall GMS and Analytics On-Prem are used for central management, rapid deployment, real-time reporting, and data insight affecting a wide area of critical components of an organization. Utilizing the vulnerability could allow the attacker access to view, add, modify or delete information in the back-end database without authentication. There is no workaround to mitigate this vulnerability but incorporating a Web Application Firewall (WAF) can reduce the likelihood of exploitation.
WHAT IS THE EXPOSURE OR RISK?
When exploited, the malicious actor may modify the back-end database, possibly including execution of system commands. The primary concern is that malicious actor can bypass authentication, allowing them to perform the attack with ease while disrupting business operations and stealing sensitive information. This means a successful injection will allow the malicious actor access to execute administrative commands.
WHAT ARE THE RECOMMENDATIONS?
Barracuda MSP recommends the following actions:
- Upgrade SonicWall Analytics to Analytics 22.214.171.124-Hotfix-1.
- Upgrade SonicWall GMS to GMS 9.3.1-SP2-Hotfix-2.
For more in-depth information about the recommendations, please visit the following links:
If you have any questions, please contact our Security Operations Center.
Taras is a Cybersecurity Analyst at Barracuda MSP. He’s a security expert, working on our Blue Team within our Security Operations Center. Taras supports our XDR service delivery, and is highly skilled at analyzing security events to detect cyber threats, helping keep our partners and their customers protected.