- Bishop Fox found a way to abuse a Sonicwall VPN error
- It allows threat actors to bypass approval and hijacking sessions
- There are thousands of vulnerable endpoints
A great vulnerability in Sonicwall VPN, which can be utilized to hijack sessions and access the target network, has now seen its first proof-of-concept (POC) attack, which means it is only a matter of time before cyber criminals begins to exploit it in nature.
At the beginning of January 2025, Sonicwall raised the alarm on a vulnerability in Sonicos and urged its users to apply the correction immediately. The error is traced as CVE-2024-53704 and is described as an incorrect approval error in the SSLVPN approval mechanism. It got a severity of 9.8/10 (critical) and was said that it could be abused to allow an external striker to bypass approval.
It affected Sonicos versions 7.1.x (up to 7.1.1-7058), 7.1.2-7019 and 8.0.0-8035. Sonicwall released versions Sonicos 8.0.0-8037 and later 7.0.1-5165 and higher, 7.1.3-7015 and higher and 6.5.5.1-6N and higher to tackle the error. At that time, there were more than 4,500 internet-exposed final points.
Proof of concept
When Sonicwall users now had time to patch, Bishop Fox security researchers emerged with more details of the vulnerability as well as a POC. After a “significant” reverse construction effort, Bishop Fox said the vulnerability could be exploited by sending a custom-built session cookie containing a base64-coded string with Nullbytes to the SSLVPN approval point.
This results in the end point provided that the request was associated with an active VPN session and incorrectly validates it. As a result, the target is logged out while the striker is given access to the session, including the opportunity to read the victim’s virtual office bookmarks, Access VPN client configuration settings, open a VPN tunnel and more.
“With that, we were able to identify the username and domain of the hijacked session along with private routes that the user was able to access through SSL VPN,” the researchers said.
Via Bleeping computer
