CVE-2023-30804
About
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the svpn_html/loadfile.php endpoint. This issue is exploitable by a remote and unauthenticated attacker when paired with CVE-2023-30803.
Rainforest analyst review
On its own this is a file-read bug in the Sangfor NGAF web console: an attacker who already holds a valid, authenticated session can call the loadfile.php endpoint and pull back arbitrary files from the appliance filesystem — configs, credentials, keys. The 4.9 score reflects that gate: it needs high-privilege access and only breaks confidentiality. Read in isolation, it looks like a minor information leak reserved for insiders.
The reason it matters far more than 4.9 suggests is written into the advisory itself: paired with CVE-2023-30803, a remote and unauthenticated attacker reaches the same endpoint. That flips the whole risk profile. A firewall is an internet-facing security control by definition, so the vulnerable path is exactly where an external attacker is already knocking, and stolen config files from a NGAF hand an attacker the keys to the network it protects.
Our line here is to treat this as one half of a chain, not a standalone medium. When we inventory Sangfor NGAF exposure we flag both CVEs together and score by the chained outcome — unauthenticated file disclosure on a perimeter appliance — rather than by this component's individual high-privilege rating. If CVE-2023-30803 is unpatched anywhere in the estate, this one rides in with it.
References
Related CVEs
Frequently asked questions
What is CVE-2023-30804?
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the svpn_html/loadfile.php endpoint. This issue is exploitable by a remote and unauthenticated attacker when paired with CVE-2023-30803.
How severe is CVE-2023-30804?
CVE-2023-30804 carries a CVSS 3.1 base score of 4.9, rated medium. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 52 out of 100, in the elevated band.
How is CVE-2023-30804 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N): attack vector Network, attack complexity Low, privileges required High, user interaction None. Impact on confidentiality High, integrity None and availability None.
Which products are affected by CVE-2023-30804?
Public advisories list the following as affected: next-gen application firewall. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2023-30804?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.