CVE DatabaseCVE-2023-1671

Updated 2026-06-17한국어 권고문 →

CVE-2023-16719.8/CRITICALCISA KEVCWE-77CWE-77

Sophos Web Appliance Pre-Auth Command Injection Vulnerability (CVE-2023-1671) Security Advisory

⚡ Jump to Patch

Affected Vendors

sophos

Affected Components

web appliance

Published Date

2023-04-04

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

100.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Sophos Web Appliance versions prior to 4.3.10.4

Impact

Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending specially crafted HTTP requests.

Mitigation

Immediately upgrade Sophos Web Appliance to version 4.3.10.4 or higher, or migrate to a supported alternative solution due to the product's End-of-Life (EOL) status.

Affected Products & Version Scope

All Sophos Web Appliance versions prior to 4.3.10.4 (Note: Sophos Web Appliance reached End-of-Life on July 20, 2023)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

If automatic updates are enabled, the appliance should update automatically. To manually trigger and verify the update process via the administrative CLI, execute:

bash

# Check for available updates and force installation on Sophos Web Appliance CLI
sysupdate --check
sysupdate --install

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict access to the Sophos Web Appliance management interface from the public internet. Implement strict firewall rules to allow access only from trusted administrative IP addresses:

bash

# Restrict access to port 443 to a trusted admin IP (e.g., 192.168.1.100) and drop all other external traffic
iptables -A INPUT -p tcp -s 192.168.1.100 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

3. Log Audit & IoC Verification Commands

Inspect the web server access logs for suspicious requests targeting the 'warn-proceed' handler containing potential command injection payloads:

bash

# Search access logs for 'warn-proceed' requests containing shell metacharacters
grep -i 'warn-proceed' /var/log/httpd/access_log | grep -E '(\||\;|\&|\`|\$)'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Since Sophos Web Appliance has reached its End-of-Life (EOL) status, apply the 4.3.10.4 patch immediately and plan an urgent migration to a supported next-generation firewall solution.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-1671) is a critical pre-authentication command injection vulnerability residing in the 'warn-proceed' handler of Sophos Web Appliance. The root cause is the lack of proper input validation and sanitization of user-supplied data before passing it to a system shell execution context (CWE-77).

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by sending a crafted HTTP request targeting the 'warn-proceed' handler via '/index.php'. By embedding shell metacharacters (such as ';', '&&', or backticks) along with malicious payloads into the vulnerable parameters, the attacker forces the underlying operating system to execute arbitrary commands under the context of the web server or root user without requiring any authentication.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk as it is actively exploited in the wild. Successful exploitation allows complete system compromise, enabling attackers to establish a persistent foothold within the internal network, exfiltrate sensitive data, and deploy ransomware.

Official Vendor Advisories & References

NVD Original English Description

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html

Source: security-alert@sophos.com · Exploit, Third Party Advisory, VDB Entry

https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce

Source: security-alert@sophos.com · Vendor Advisory

http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1671

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2023-1671)

FAQ

Q1. How critical is CVE-2023-1671 and is it actively exploited in the wild?

CVE-2023-1671 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2023-1671?

Primary impacted vendors include sophos across web appliance. Scope summary: All Sophos Web Appliance versions prior to 4.3.10.4 (Note: Sophos Web Appliance reached End-of-Life on July 20, 2023)

Q3. What temporary mitigations or workarounds exist for CVE-2023-1671 before patching?

[Mitigation] Immediately upgrade Sophos Web Appliance to version 4.3.10.4 or higher, or migrate to a supported alternative solution due to the product's End-of-Life (EOL) status. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION