Rewterz Threat Advisory – Multiple SonicWall GMS and Analytics Products Vulnerabilities

Severity

High

Analysis Summary

CVE-2023-34129 CVSS:7.1

SonicWall GMS and Analytics could allow a remote authenticated attacker to traverse directories on the system. An attacker could exploit this vulnerability to create or overwrite existing files on the filesystem with root privileges. Note: This vulnerability is known as “Zip-Slip”.

CVE-2023-34125 CVSS:6.5

SonicWall GMS and Analytics could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of user requests by the backup file. An attacker could send a specially crafted URL request containing “dot dot” sequences (/../) using the filename parameter to read arbitrary files on the system.

CVE-2023-34135 CVSS:6.5

SonicWall GMS and Analytics could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of user requests by the Web Service. An attacker could send a specially crafted URL request containing “dot dot” sequences (/../) to read arbitrary files on the system.

CVE-2023-34123 CVSS:7.5

SonicWall GMS and Analytics could provide weaker than expected security, caused by the use of a predictable password reset key. An attacker could exploit this vulnerability to launch further attacks on the system.

CVE-2023-34131 CVSS:5.3

SonicWall GMS and Analytics could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to leak sensitive information such as the device serial number, internal IP addresses and host names.

CVE-2023-34126 CVSS:7.1

SonicWall GMS and Analytics could allow a remote authenticated attacker to upload arbitrary files, caused by improper validation of file extensions. An attacker could exploit this vulnerability to upload a malicious file, which could allow the attacker to execute arbitrary code on the system with root privileges.

CVE-2023-34130 CVSS:5.3

SonicWall GMS and Analytics could provide weaker than expected security, caused by the use of outdated cryptographic algorithm with hardcoded key. A remote authenticated attacker could exploit this vulnerability to launch further attacks on the system.

CVE-2023-34137 CVSS:9.4

SonicWall GMS and Analytics could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability to bypass CAS authentication.

CVE-2023-34136 CVSS:6.5

SonicWall GMS and Analytics could allow a remote attacker to upload arbitrary files, caused by improper validation of file extensions. An attacker could exploit this vulnerability to upload a malicious file, which could allow the attacker to execute arbitrary code on the system.

CVE-2023-34134 CVSS:9.8

SonicWall GMS and Analytics could allow a remote attacker to obtain sensitive information, caused by an error in the Web Service. An attacker could exploit this vulnerability to read the password hash.

CVE-2023-34128 CVSS:6.5

SonicWall GMS and Analytics could allow a remote authenticated attacker to gain elevated privileges on the system, caused by the use of hardcoded Tomcat credentials. An attacker could exploit this vulnerability to gain elevated privileges on the system.

CVE-2023-34124 CVSS:9.4

SonicWall GMS and Analytics could allow a remote attacker to bypass security restrictions, caused by insufficient checks. An attacker could exploit this vulnerability to bypass the Web service authentication mechanism.

CVE-2023-34132 CVSS:4.9

SonicWall GMS and Analytics could allow a remote authenticated attacker to bypass security restrictions, caused by an error related to the Client-Side Hashing function allowing Pass-the-Hash. An attacker could exploit this vulnerability to bypass security restrictions.

CVE-2023-34133 CVSS:9.8

SonicWall GMS and Analytics are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

CVE-2023-34127 CVSS:8.8

SonicWall GMS and Analytics could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an OS command injection vulnerability. An attacker could exploit this vulnerability to inject and execute arbitrary commands on the system.

Impact

• Gain Access
• Information Theft
• Privileges Escalation
• Security Bypass

Indicators Of Compromise

CVE

• CVE-2023-34129
• CVE-2023-34125
• CVE-2023-34135
• CVE-2023-34123
• CVE-2023-34131
• CVE-2023-34126
• CVE-2023-34130
• CVE-2023-34137
• CVE-2023-34136
• CVE-2023-34134
• CVE-2023-34128
• CVE-2023-34124
• CVE-2023-34132
• CVE-2023-34133
• CVE-2023-34127

Affected Vendors

Sonicwall

Affected Products

• SonicWall GMS 9.3.2 SP1
• SonicWall Analytics 2.5.0.4 R7

Remediation

Refer to SonicWall Security Advisory for patch, upgrade or suggested workaround information.

SonicWall Security Advisory