CVE-2023-1671
Sophos Web Appliance Command Injection Vulnerability
Description
CVE-2023-1671 is a critical pre-authentication command injection vulnerability in the Sophos Web Appliance, specifically in the warn-proceed handler component. This flaw allows an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system of the appliance without any prior authentication. Affecting Sophos Web Appliance versions older than 4.3.10.4, CVE-2023-1671 enables full system compromise including data theft, malware installation, and lateral movement within the network. CISA has confirmed active exploitation by adding this vulnerability to its Known Exploited Vulnerabilities catalog, and the EPSS score of 94.3% (99th percentile) indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sophos | web appliance | < 4.3.10.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1671(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command (Command Injection)
CWE-77 describes a weakness where software constructs command strings using externally influenced input without properly neutralizing special elements that could modify the intended command. In the case of CVE-2023-1671, the Sophos Web Appliance warn-proceed handler fails to sanitize user-supplied input before passing it to system command execution functions, allowing attackers to inject and execute arbitrary OS commands.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command
Impact Analysis
CVE-2023-1671 carries a CVSS v3.1 base score of 9.8 (Critical severity), reflecting the maximum possible risk across nearly all scoring dimensions. The vulnerability is remotely exploitable over the network with low attack complexity, requiring no special conditions or timing for successful exploitation. Privileges Required (None): No authentication or user credentials are needed to exploit this vulnerability, making it accessible to any attacker with network access to the appliance. User Interaction (None): No action from a legitimate user is required — the attack can be executed entirely autonomously. Confidentiality (High): Successful exploitation grants the attacker full read access to all data on the appliance, including configuration files, credentials, and network traffic logs. Integrity (High): The attacker can modify system configurations, inject malicious code, and alter or destroy data. Availability (High): The attacker can disrupt or completely disable the Sophos Web Appliance, impacting web filtering and security enforcement for the entire organization. The EPSS score of 94.3% indicates near-certain active exploitation, and public exploit code is readily available.
Exploit Maturity
Public exploit code is available for CVE-2023-1671 via Packet Storm Security, providing a ready-to-use proof-of-concept that significantly lowers the barrier to exploitation. CISA has confirmed active exploitation in the wild by adding CVE-2023-1671 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 7, 2023. The EPSS score of 94.3% (99th percentile) indicates near-certain exploitation activity, placing it among the most actively targeted vulnerabilities. While the ransomware association is currently listed as unknown, the combination of pre-authentication access, critical severity, and readily available exploit code makes this vulnerability extremely dangerous.
Remediation
- Upgrade Sophos Web Appliance to version 4.3.10.4 or later immediately. Apply mitigations per vendor instructions as detailed in the Sophos security advisory. If upgrading is not possible, discontinue use of the product.
- Isolate affected Sophos Web Appliances from the network until the patch is applied. Place the appliance behind a firewall that restricts access to the management and warn-proceed handler interfaces to trusted IP addresses only.
- Implement strict input validation and command execution controls. As an interim measure, deploy web application firewall (WAF) rules to filter requests containing command injection payloads targeting the warn-proceed handler endpoint.
- Conduct a forensic review of affected systems. Check system logs, process lists, and network connections for signs of unauthorized command execution. Look for unexpected outbound connections, new user accounts, or modified system files that may indicate prior compromise.
- Implement network segmentation to limit the blast radius of any compromised security appliance. Ensure that the Sophos Web Appliance cannot directly access sensitive internal systems and that outbound traffic is monitored and restricted.
Technical Details
CVE-2023-1671 is a pre-authentication command injection vulnerability in the warn-proceed handler of the Sophos Web Appliance. The vulnerability stems from improper neutralization of special elements in user-supplied input (CWE-77), where the application passes externally controlled data directly to operating system command execution functions without adequate sanitization. Attack Vector (Network): The vulnerable handler is accessible over the network, allowing remote exploitation without any physical or adjacent network access. Attack Complexity (Low): The command injection requires no special conditions, race conditions, or environmental prerequisites — a single crafted HTTP request to the warn-proceed handler is sufficient to achieve arbitrary command execution. Privileges Required (None): The vulnerability exists in a pre-authentication code path, meaning no valid credentials or session tokens are needed. The attacker interacts with the warn-proceed handler before any authentication check occurs, which is why the vulnerability is classified as pre-auth. Once exploited, the attacker gains command execution with the privileges of the web appliance process, which typically runs with elevated permissions sufficient to control the entire appliance and its network filtering capabilities.
Frequently Asked Questions
Is CVE-2023-1671 being actively exploited?
Yes, CVE-2023-1671 is being actively exploited. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 7, 2023. Public exploit code is available on Packet Storm Security, and the EPSS score of 94.3% (99th percentile) indicates near-certain exploitation in the wild.
What products are affected by CVE-2023-1671?
CVE-2023-1671 affects the Sophos Web Appliance in all versions prior to 4.3.10.4. Organizations running any older version of the Sophos Web Appliance are vulnerable to pre-authentication command injection through the warn-proceed handler.
How do I fix CVE-2023-1671?
Upgrade the Sophos Web Appliance to version 4.3.10.4 or later as documented in the Sophos security advisory. If immediate patching is not possible, isolate the appliance from the network and restrict access to the management interface. Conduct a forensic review to check for signs of prior compromise.
How severe is CVE-2023-1671?
CVE-2023-1671 is rated Critical with a CVSS v3.1 base score of 9.8 out of 10. It requires no authentication, no user interaction, and can be exploited remotely with low complexity. The EPSS score of 94.3% (99th percentile) and the availability of public exploit code make this one of the most dangerous actively exploited vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.