CVE-2022-1040

This vulnerability allows an attacker to gain unauthorized access to the firewall management space by bypassing authentication

CVE-2022-1040 : Sophos XG115w Firewall 17010 MR-10 - Authentication Bypass This vulnerability allows an attacker to gain unauthorized access to the firewall management space by bypassing authentication ☕️ Live : updated

New exploitation of 2020 Sophos vuln

CVE-2022-1040-sophos-rce-poc sophos rce poc sophos webmin portal auth bypass and rce all in one script; The vulnerability affects Sophos Firewall v185 MR3 (1853) and older Mitigation: update to latest version asap supportsophoscom/support/s/article/KB-000043853?language=en_US to avoid misusing of this script its not for free: it contains the script and a freshly du

may the poc with you

CVE-2022-1040 may the poc with you 外面捡来的 curl --insecure -H "X-Requested-With: XMLHttpRequest" -X POST 'xxxx/userportal/Controller?mode=8700&operation=1&datagrid=179&json=\{"🦞":"test"\}'

Sophos EXploit

CVE-2022-1040 Here is the Sophos exploit found on 2022-08-04 working on version 17010 MR-10

CVE-2022-1040

Save the trouble to open the burpsuite...

Environment In Python Environment(310) # It's strongly recommended to use the virtual environment) pip3 install baseproxy # python310 will raise an AttributeError if the version of pyOpenSSL(downloaded with baseproxy) is too low Reinstalling the latest version will fix it pip3 uninstall pyOpenSSL pip3 install pyOpenSSL # run python3 Sophos-pocpy

CVE-2022-1040

Análisis Vulnerabilidad CVE-2022-1040 (Sophos RCE) En el grupo de investigación Toasec, dedicado a ciberseguridad ofensiva nos dimos la tarea de realizar el análisis sobre esta vulnerabilidad en los firewalls de Sophos Dicha vulnerabilidad como muchas otras pueden ser notificadas y encontradas si sabes buscar en twitter, en donde observamos que desde el me