Dive Brief:
- More than 5,000 instances of an authentication bypass flaw in SonicWall firewalls are exposed to the internet and 460 were listed as vulnerable to exploitation, according to a report released Friday by Censys. The number of vulnerable instances was down to 445 as of Tuesday, researchers said.
- The vulnerability, listed as CVE-2024-53704, is an improper authentication vulnerability in the SSL VPN mechanism that can allow a remote attacker to bypass authentication.
- Security researchers earlier this month warned of active exploitation attempts against CVE-2024-53704, and the Cybersecurity and Infrastructure Security Agency added the flaw to its known exploited vulnerabilities catalog.
Dive Insight:
SonicWall issued an advisory and patched the vulnerability in January. However, researchers from Bishop Fox released a proof of concept earlier this month, and Arctic Wolf subsequently reported attempts to exploit the vulnerability.
SonicWall previously warned the proof of concept significantly increases the risk of exploitation and urged customers to immediately patch. If upgrading firmware is not possible, the company said disabling the SSL VPN was another option.
The flaw was linked to the improper handling of base64-encoded session cookies. The getSslvpnSessionFromCookie function fails to properly verify session cookies, according to Bishop Fox and Censys.
The vulnerability affects SonicWall TZ, NSa, NSsp series firewalls and NSv series virtual firewalls, according to Censys.
