CVE-2023-1671

A pre-authentication command injection in the warn-proceed handler of the Sophos Web Appliance lets an unauthenticated attacker pass shell metacharacters into a parameter that is used to build a system command. Because the handler is reachable without login, a single crafted HTTP request runs arbitrary code on the appliance with the privileges of the affected service, giving an attacker a foothold on a device that inspects and proxies user web traffic.

A secure web gateway is a high-value target precisely because it sits inline for outbound browsing: it terminates connections, sees plaintext for the traffic it decrypts, and is trusted by every client behind it, so control of the appliance means visibility into and manipulation of an organization's web traffic. Sophos Web Appliance additionally reached end of life shortly after this disclosure, which raises the stakes for anyone still running it, since no ongoing support closes future issues. Apply the fix for versions older than 4.3.10.4, keep the management interface off untrusted networks, and if the product is past end-of-life in your environment, prioritize decommissioning it over patching.