CVE-2020-12271

CVE-2020-12271: Critical SQL Injection in Sophos XG Firewall SFOS (ASnarok)

AI-generated analysis based on the vulnerability data on this page.

Summary

In April 2020, Sophos disclosed a critical SQL injection vulnerability in the XG Firewall operating system (SFOS) that was actively exploited in the wild. Tracked as CVE-2020-12271 and codenamed "ASnarok" by Sophos, the flaw allowed unauthenticated attackers to inject malicious SQL commands through exposed management interfaces, potentially achieving remote code execution and exfiltrating sensitive credential data from the appliance.

Background

Sophos XG Firewall is a next-generation firewall appliance used by enterprises and managed service providers to enforce perimeter security policies, VPN remote access, and web filtering. In late April 2020, Sophos reported that a subset of XG Firewall appliances had been compromised through a zero-day SQL injection flaw. The attack primarily targeted devices that had either the administration (HTTPS) service or the User Portal accessible from the WAN zone. Sophos pushed an emergency hotfix and notified affected customers directly.

Root Cause

The vulnerability is classified under CWE-89: SQL Injection. Insufficient input sanitization in a web-facing component of the XG Firewall management interface allowed attacker-supplied data to be concatenated directly into SQL queries. By manipulating specific HTTP parameters sent to the exposed portal pages, an attacker could alter query logic, bypass authentication checks, and execute arbitrary SQL commands against the device's internal database. The flaw did not require prior authentication, making it trivially exploitable over the internet.

Impact

The National Vulnerability Database assigns this flaw a CVSS v3.1 score of 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The metrics reflect that the attack is network-exploitable, requires no privileges or user interaction, and can result in high impacts to confidentiality, integrity, and availability.

Sophos confirmed that successful exploitation could lead to remote code execution on the firewall appliance. In observed incidents, attackers exfiltrated usernames and hashed passwords for local device administrators, portal administrators, and user accounts configured for remote access. Notably, the compromise did not extend to externally managed Active Directory or LDAP passwords.

Exploitation Walkthrough

Ethics Notice: The following description is provided for defensive awareness only. No weaponized exploit code is included.

1. Reconnaissance: The attacker scans for internet-facing Sophos XG Firewalls with either the admin HTTPS service or the User Portal enabled on the WAN interface.
2. Injection Point Identification: The attacker sends crafted HTTP requests to portal endpoints that interact with the backend SQL database, supplying malicious payloads in parameters expected to contain benign identifiers or credentials.
3. Authentication Bypass / Query Manipulation: Because the application concatenates user input into SQL statements without proper parameterization, the injected SQL alters query semantics. This can bypass authentication or cause the database to return data outside the intended query scope.
4. Post-Exploitation: With database access, the attacker may read credential tables and, depending on the environment, achieve further code execution through database-specific primitives or by leveraging the underlying operating system.

Affected and Patched Versions

The following SFOS versions were confirmed vulnerable:

• SFOS 17.0
• SFOS 17.1
• SFOS 17.5
• SFOS 18.0 (before the 2020-04-25 hotfix)

Sophos released an automatic hotfix on 25 April 2020 for XG Firewalls with the auto-update feature enabled. Devices without auto-update required manual intervention.

Remediation

1. Apply the Hotfix / Upgrade: Ensure the appliance is running a patched SFOS build released on or after 25 April 2020. If the device was compromised, Sophos recommended a full device reset and reconfiguration rather than relying solely on the patch.
2. Reduce WAN Exposure: Do not expose the XG Firewall administration interface or User Portal to untrusted networks. Restrict access to an internal management VLAN or a hardened jump host.
3. Network Segmentation: Place management interfaces on isolated segments with strict ingress and egress filtering.
4. Credential Rotation: Reset all local admin, portal admin, and VPN user passwords. Review VPN user accounts for unauthorized access or configuration changes.
5. Compensating Controls: Deploy a web application firewall (WAF) or reverse proxy in front of management portals to enforce parameterized input validation and rate limiting.

Detection

• Firewall Logs: Monitor for unexpected source IPs accessing /userportal or the admin HTTPS service from the WAN zone.
• Database Integrity Checks: Sophos provided guidance for verifying whether the device had been compromised by checking for specific indicators of tampering.
• Egress Monitoring: Look for anomalous outbound connections from the firewall appliance to unfamiliar external hosts, which may indicate exfiltration or command-and-control activity.
• Authentication Anomalies: Alert on sudden changes to local administrator accounts or the creation of unexpected VPN user profiles.

Assessment

CVE-2020-12271 carries an EPSS score of 0.42164 (approximately the 98.5th percentile), indicating a very high probability of real-world exploitation. It is also listed in CISA's Known Exploited Vulnerabilities catalog, with exploitation confirmed since 2021-11-03. The combination of a critical CVSS score, zero-authentication requirements, and observed in-the-wild exploitation makes this a textbook example of why edge security appliances must never expose management interfaces to the public internet. Two key lessons emerge: first, administrative portals should always reside on out-of-band networks; second, automatic security updates on critical infrastructure can substantially shrink the window of opportunity for attackers.

References

• https://community.sophos.com/kb/en-us/135412
• https://cwe.mitre.org/data/definitions/89.html
• https://news.sophos.com/en-us/2020/04/26/asnarok/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12271