CVE-2023-34124
SonicWALL GMS Virtual Appliance HttpDigestAuthenticator Authentication Bypass Vulnerability
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
This vulnerability allows remote attackers to bypass authentication on affected installations of SonicWALL GMS Virtual Appliance. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the HttpDigestAuthenticator class. The issue results from a predictable digest credential in the authentication mechanism. An attacker can leverage this vulnerability to bypass authentication on the system.
*Credits:
Alex Birnberg of Zymo Security
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-05-25 CVE Reserved
- 2023-07-12 First Exploit
- 2023-07-13 CVE Published
- 2024-08-02 CVE Updated
- 2024-08-26 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-287: Improper Authentication
- CWE-305: Authentication Bypass by Primary Weakness
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/174571/Sonicwall-GMS-9.9.9320-Remote-Code-Execution.html |
|
| URL | Date | SRC |
|---|---|---|
| https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/sonicwall_shell_injection_cve_2023_34124.rb | 2023-07-12 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010 | 2023-09-08 | |
| https://www.sonicwall.com/support/notices/230710150218060 | 2023-09-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sonicwall Search vendor "Sonicwall" | Analytics Search vendor "Sonicwall" for product "Analytics" | <= 2.5.0.4-r7 Search vendor "Sonicwall" for product "Analytics" and version " <= 2.5.0.4-r7" | - |
Affected
| ||||||
| Sonicwall Search vendor "Sonicwall" | Global Management System Search vendor "Sonicwall" for product "Global Management System" | < 9.3.2 Search vendor "Sonicwall" for product "Global Management System" and version " < 9.3.2" | - |
Affected
| ||||||
| Sonicwall Search vendor "Sonicwall" | Global Management System Search vendor "Sonicwall" for product "Global Management System" | 9.3.2 Search vendor "Sonicwall" for product "Global Management System" and version "9.3.2" | - |
Affected
| ||||||
| Sonicwall Search vendor "Sonicwall" | Global Management System Search vendor "Sonicwall" for product "Global Management System" | 9.3.2 Search vendor "Sonicwall" for product "Global Management System" and version "9.3.2" | sp1 |
Affected
| ||||||