Price: 0.00178500 BTC

$140.01 USD (by current exchange rate)

Sale Count: Unlimited

Total: 1 file(s)

Hidden text contain: 0 symbol(s)

Download file(s):

CVE-2026-83548.zip 11.84KB

Info(Description by file owner):

# CVE-2026-83548 — SonicWall SMA1000 Work Place pre-auth SSRF

Single-file tool (Python 3, standard library only, zero dependencies) for
assessing and exploiting the pre-authentication SSRF in the **Work Place**
interface of SonicWall SMA1000 appliances (6210 / 7210 / 8200v), including an
opportunistic chain to unauthenticated RCE via CVE-2026-83549.

## The vulnerability

| | |
|---|---|
| CVE | CVE-2026-83548 (SSRF, CWE-918/CWE-441), CVSS 10.0 |
| Chain | CVE-2026-83549 — OS command injection in the AMC (post-auth), bypassed through the SSRF |
| Mechanism | The Work Place interface behaves as an **unintended forward proxy**: the appliance forwards crafted requests to internal resources (including the AMC) using its own privileged network position, with no authentication required at any stage |
| Affected | SMA1000 ≤ 12.4.3-03453 and ≤ 12.5.0-02835 |
| Fixed | **12.4.3-03526** / **12.5.0-02952** (SonicWall notice SNWLID-2026-0016) |
| Status | Actively exploited in the wild; CISA KEV since 2026-09-02; no workaround — patch only |

## What the tool does (stages)

- **[A] Fingerprint + patch-state** — read-only GET of the Work Place portal
root: `Server: SMA/*` banner, `__extraweb__` assets, version from help
links; classification against the fixed builds (PATCHED / AFFECTED /
POTENTIALLY_AFFECTED / NOT_SMA1000).
- **[B] SSRF vector probing** — tests a candidate set of SSRF trigger
vectors (including the `/cgi-bin/` relay path and the forward-proxy
"absolute URI as path" shape) and scores anomalies against a baseline:
status-code shift, latency delta, new response headers, body delta.
Operator-supplied vectors are accepted via `--vector` (repeatable).
- **[C] Out-of-band confirmation** — spins up a local capture listener and
points the best vector at it. A captured request (method/headers/forwarded
User-Agent) proves the appliance forwarded the request — the actual
vulnerability, not a timing artifact.
- **[D] RCE chain (CVE-2026-83549)** — opportunistic command-injection
attempt against the AMC through the confirmed SSRF relay, with exfil of a
marker via curl/wget/nc. Confirmation requires an out-of-band capture.

## Quick start

```bash
# Fingerprint / patch-state only (read-only)
python3 exploit_cve_2026_83548.py --fingerprint-only vpn.example.com

# Full pass: vector probing + out-of-band SSRF confirmation
python3 exploit_cve_2026_83548.py --listen --attacker-ip \
--oob-timeout 5 vpn.example.com

# + RCE chain attempt (default command: id)
python3 exploit_cve_2026_83548.py --listen --attacker-ip --rce \
--rce-cmd 'id' vpn.example.com

# Known vector (bypasses the default candidate set), JSON report
python3 exploit_cve_2026_83548.py --json --skip-probe \
--vector 'POST:/cgi-bin/:url={T}' --listen --attacker-ip \
-k -t 10 203.0.113.10

# Multiple targets in sequence (exit code = worst verdict)
python3 exploit_cve_2026_83548.py --listen --attacker-ip \
vpn-a.example.com vpn-b.example.com
```

`--attacker-ip` — the IP from which the appliance must be able to reach your
capture listener (`127.0.0.1` for local checks; a network-visible address plus
port forwarding for remote). Without it the tool guesses a local IP, which
often does not work inside containers/VPN setups.

## Exit codes

| Code | Meaning |
|---|---|
| 0 | patched / not affected |
| 1 | affected by version, or SSRF confirmed, or affected firmware line with undetermined exact build |
| 2 | unauthenticated RCE confirmed (chain succeeded) |
| 3 | target is not an SMA1000 Work Place portal |
| 4 | connection/other error |

## Limitations (read this)

1. Stage D is opportunistic: confirmation requires an out-of-band capture;
absence of one is not a refutation.
2. OOB capture requires that the appliance can reach your listener
(same L2 / port forward / VPN). A capture timeout ≠ SSRF refuted.
3. Version verdict: the appliance typically exposes only its firmware line
(e.g. `12.5.0`) externally, not the exact hotfix build — the common result
is `POTENTIALLY_AFFECTED`, which requires confirming the build on the
appliance itself.
4. Stages B–D send requests to the target by design; use only against hosts
you own or are explicitly permitted to test.