CVE-2021-20022
SonicWall Email Security Unrestricted Upload of File Vulnerability
Description
CVE-2021-20022 is a high-severity unrestricted file upload vulnerability in SonicWall Email Security version 10.0.9.x. The flaw allows a post-authenticated attacker to upload arbitrary files to the remote host, potentially including web shells or other malicious executables that enable remote code execution. CISA has added CVE-2021-20022 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and this vulnerability is known to be used in ransomware campaigns. With an EPSS score of 20.02% (95.39th percentile), exploitation probability is significant. This vulnerability is commonly exploited as part of an attack chain together with CVE-2021-20021 (administrative account creation) and CVE-2021-20023 (path traversal) to achieve full system compromise on SonicWall Email Security appliances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | email security | < 10.0.9.6103 |
| sonicwall | email security appliance 9000 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 3300 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 4300 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 8300 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 5000 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 7000 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 5050 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 7050 firmware | < 10.0.9.6105 |
| sonicwall | email security virtual appliance | < 10.0.9.6105 |
| sonicwall | hosted email security | < 10.0.9.6103 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0008(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20022(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload occurs when software allows users to upload files without properly validating or restricting the file types. In the case of SonicWall Email Security, this weakness allows a post-authenticated attacker to upload files with dangerous content such as web shells or scripts that can be executed on the server, providing direct code execution capabilities on the target system.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2021-20022 carries a CVSS 3.1 score of 7.2 (HIGH), indicating a serious threat to organizations using SonicWall Email Security. The vulnerability is remotely exploitable over the network with low attack complexity, though it requires high-privilege (administrative) authentication and no user interaction. Successful exploitation results in high impact across confidentiality, integrity, and availability, as an attacker who has gained administrative access can upload malicious files including web shells to achieve persistent remote code execution. The EPSS score of 20.02% places this vulnerability in the 95.39th percentile, indicating significant exploitation activity. This vulnerability is known to be used in ransomware campaigns and is most dangerous when chained with CVE-2021-20021, which provides the unauthenticated administrative account creation needed to exploit CVE-2021-20022 without prior credentials.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-20022 in the wild by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-11-17. This vulnerability is known to be used in ransomware campaigns, significantly elevating remediation urgency. The EPSS score of 20.02% indicates significant exploitation probability. CVE-2021-20022 is typically exploited as part of a three-stage attack chain: first, CVE-2021-20021 is used to create an unauthorized administrative account without authentication; then CVE-2021-20022 is leveraged to upload a web shell or other malicious payload; finally, CVE-2021-20023 enables reading sensitive files from the system for data exfiltration.
Remediation
- Apply updates immediately as required by CISA KEV: update SonicWall Email Security to version 10.0.9.6103 or later for virtual deployments, and to version 10.0.9.6105 or later for hardware appliances (models 3300, 4300, 5000, 5050, 7000, 7050, 8300, 9000).
- Verify that all SonicWall Email Security instances have been patched. Critically, also address CVE-2021-20021 and CVE-2021-20023, which form the complete exploit chain with this vulnerability.
- If immediate patching is not possible, implement strict file upload validation including whitelist-based file type restrictions, rename uploaded files to prevent execution, and store uploads in locations that cannot execute scripts. Restrict management interface access to trusted networks only.
- Monitor for indicators of compromise including newly uploaded suspicious files (especially web shells), unexpected administrator accounts, and unusual outbound network connections. Scan the file system for known web shell signatures.
- As a long-term measure, implement defense-in-depth for file uploads: validate file content using magic bytes rather than extensions alone, use a separate domain for serving uploaded content, and conduct regular security audits of file upload functionality across all appliances.
Technical Details
CVE-2021-20022 exploits an unrestricted file upload vulnerability in SonicWall Email Security version 10.0.9.x where the application fails to properly validate and restrict file types during upload operations. A post-authenticated attacker with administrative privileges can upload arbitrary files, including executable scripts and web shells, to the server. The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms that while the vulnerability requires high-privilege authentication, exploitation is straightforward with no special conditions needed, and the impact spans full compromise of confidentiality, integrity, and availability. The high privilege requirement is effectively negated when this vulnerability is chained with CVE-2021-20021, which allows unauthenticated creation of administrative accounts. The vulnerability affects the same range of SonicWall products including Email Security software, hardware appliances, virtual appliances, and hosted deployments.
Frequently Asked Questions
Is CVE-2021-20022 being actively exploited?
Yes. CVE-2021-20022 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. It is known to be used in ransomware campaigns, typically as part of an exploit chain with CVE-2021-20021 and CVE-2021-20023. The EPSS score of 20.02% (95.39th percentile) indicates significant exploitation probability.
What products are affected by CVE-2021-20022?
CVE-2021-20022 affects SonicWall Email Security version 10.0.9.x, including the software version (prior to 10.0.9.6103), Hosted Email Security (prior to 10.0.9.6103), Email Security Virtual Appliance (prior to 10.0.9.6105), and all hardware appliance models 3300, 4300, 5000, 5050, 7000, 7050, 8300, and 9000 (prior to firmware 10.0.9.6105).
How do I fix CVE-2021-20022?
Update SonicWall Email Security to version 10.0.9.6103 or later for software and hosted deployments, and to version 10.0.9.6105 or later for hardware appliances. Ensure you also patch CVE-2021-20021 and CVE-2021-20023, which form the complete exploit chain.
How severe is CVE-2021-20022?
CVE-2021-20022 has a CVSS 3.1 score of 7.2 (HIGH) and an EPSS score in the 95.39th percentile. While it requires administrative authentication, when chained with CVE-2021-20021, it becomes exploitable without prior credentials and is actively used in ransomware attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.