CVE-2021-20023
SonicWall Email Security Path Traversal Vulnerability
Description
CVE-2021-20023 is a medium-severity path traversal vulnerability in SonicWall Email Security version 10.0.9.x. The flaw allows a post-authenticated attacker to read arbitrary files on the remote host by exploiting improper limitation of file path access. CISA has added CVE-2021-20023 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and this vulnerability is known to be used in ransomware campaigns. With an EPSS score of 48.57% (97.70th percentile), exploitation probability is high. CVE-2021-20023 is commonly exploited as the final stage of an attack chain together with CVE-2021-20021 (administrative account creation) and CVE-2021-20022 (arbitrary file upload) to achieve complete compromise and data exfiltration on SonicWall Email Security appliances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | email security | < 10.0.9.6173 |
| sonicwall | email security appliance 9000 firmware | < 10.0.9.6177 |
| sonicwall | email security appliance 3300 firmware | < 10.0.9.6177 |
| sonicwall | email security appliance 4300 firmware | < 10.0.9.6177 |
| sonicwall | email security appliance 8300 firmware | < 10.0.9.6177 |
| sonicwall | email security appliance 5000 firmware | < 10.0.9.6177 |
| sonicwall | email security appliance 7000 firmware | < 10.0.9.6177 |
| sonicwall | email security appliance 5050 firmware | < 10.0.9.6177 |
| sonicwall | email security appliance 7050 firmware | < 10.0.9.6177 |
| sonicwall | email security virtual appliance | < 10.0.9.6177 |
| sonicwall | hosted email security | < 10.0.9.6173 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0010(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20023(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path traversal occurs when software uses external input to construct file paths without properly neutralizing special elements such as ".." sequences that can escape the intended directory. In the case of SonicWall Email Security, this weakness allows a post-authenticated attacker to manipulate file path parameters to read arbitrary files beyond the restricted directory, potentially exposing sensitive configuration data, credentials, and system files.
Learn more: CWE-22 — Path Traversal
Impact Analysis
CVE-2021-20023 carries a CVSS 3.1 score of 4.9 (MEDIUM), indicating a moderate standalone threat, though its real-world impact is significantly amplified when used as part of an exploit chain. The vulnerability is remotely exploitable over the network with low attack complexity, requires high-privilege (administrative) authentication, and no user interaction. The confidentiality impact is rated HIGH while integrity and availability remain unaffected, meaning an attacker can read sensitive files but cannot modify them or disrupt service availability. The EPSS score of 48.57% places this vulnerability in the 97.70th percentile, indicating high exploitation activity. Critically, this vulnerability is known to be used in ransomware campaigns and serves as the data exfiltration component in the SonicWall Email Security exploit chain, enabling attackers to extract credentials, configuration files, and other sensitive data from compromised appliances.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-20023 in the wild by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-11-17. This vulnerability is known to be used in ransomware campaigns, significantly elevating remediation urgency. The EPSS score of 48.57% indicates high exploitation probability. CVE-2021-20023 functions as the third stage in a well-documented attack chain: CVE-2021-20021 creates an unauthorized administrative account, CVE-2021-20022 uploads a malicious payload such as a web shell, and CVE-2021-20023 reads sensitive files from the system to extract credentials and configuration data for lateral movement and further compromise.
Remediation
- Apply updates immediately as required by CISA KEV: update SonicWall Email Security to version 10.0.9.6173 or later for virtual deployments, and to version 10.0.9.6177 or later for hardware appliances (models 3300, 4300, 5000, 5050, 7000, 7050, 8300, 9000).
- Verify that all SonicWall Email Security instances have been patched. Critically, also address CVE-2021-20021 and CVE-2021-20022, which form the complete exploit chain with this vulnerability.
- If immediate patching is not possible, restrict network access to the SonicWall Email Security management interface to trusted administrative networks only, and implement strict input validation on file path parameters to prevent directory traversal sequences.
- Monitor for indicators of compromise including unusual file access patterns, attempts to read system files such as /etc/passwd or configuration files, and evidence of data exfiltration. Review access logs for suspicious authenticated sessions accessing file download endpoints.
- As a long-term measure, implement canonical path validation to ensure all file access resolves within the intended directory, use indirect file references instead of user-supplied paths, and run the application with minimal file system permissions to limit the scope of accessible files.
Technical Details
CVE-2021-20023 exploits a path traversal vulnerability in SonicWall Email Security version 10.0.9.x where the application fails to properly restrict file path input, allowing a post-authenticated attacker to use directory traversal sequences (such as "../") to escape the intended directory and read arbitrary files on the system. The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confirms that the vulnerability is network-exploitable with low complexity, requires high-privilege authentication, and impacts only confidentiality with no effect on integrity or availability. The high privilege requirement is effectively bypassed when chained with CVE-2021-20021, which enables unauthenticated administrative account creation. The vulnerability affects multiple SonicWall products with varying patch versions: Email Security software and Hosted Email Security require version 10.0.9.6173 or later, while hardware appliances (3300, 4300, 5000, 5050, 7000, 7050, 8300, 9000) and virtual appliances require version 10.0.9.6177 or later.
Frequently Asked Questions
Is CVE-2021-20023 being actively exploited?
Yes. CVE-2021-20023 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. It is known to be used in ransomware campaigns, typically as the data exfiltration stage of an exploit chain with CVE-2021-20021 and CVE-2021-20022. The EPSS score of 48.57% (97.70th percentile) indicates high exploitation probability.
What products are affected by CVE-2021-20023?
CVE-2021-20023 affects SonicWall Email Security version 10.0.9.x, including the software version (prior to 10.0.9.6173), Hosted Email Security (prior to 10.0.9.6173), Email Security Virtual Appliance (prior to 10.0.9.6177), and all hardware appliance models 3300, 4300, 5000, 5050, 7000, 7050, 8300, and 9000 (prior to firmware 10.0.9.6177).
How do I fix CVE-2021-20023?
Update SonicWall Email Security to version 10.0.9.6173 or later for software and hosted deployments, and to version 10.0.9.6177 or later for hardware appliances and virtual appliances. Also patch CVE-2021-20021 and CVE-2021-20022, which form the complete exploit chain.
How severe is CVE-2021-20023?
CVE-2021-20023 has a CVSS 3.1 score of 4.9 (MEDIUM), but its real-world severity is higher when combined with CVE-2021-20021 and CVE-2021-20022 in an exploit chain. The EPSS score is in the 97.70th percentile, and the vulnerability is actively used in ransomware campaigns for data exfiltration.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.