CVE-2020-12271: Sophos XG Firewall SQL Injection Flaw

CVE-2020-12271 Overview

A critical SQL injection vulnerability was discovered in Sophos XG Firewall devices running SFOS versions 17.0, 17.1, 17.5, and 18.0 before April 25, 2020. This vulnerability was actively exploited in the wild during April 2020, making it a high-priority security concern for organizations using affected Sophos firewall products. The flaw affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone, allowing unauthenticated remote attackers to execute arbitrary SQL commands.

Critical Impact

Successful exploitation enables remote code execution and data exfiltration, including usernames and hashed passwords for local device administrators, portal admins, and remote access user accounts. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

Affected Products

• Sophos SFOS 17.0
• Sophos SFOS 17.1
• Sophos SFOS 17.5
• Sophos SFOS 18.0 (before 2020-04-25)
• Sophos XG Firewall hardware devices

Discovery Timeline

• 2020-04-25 - Sophos releases security patch
• 2020-04-27 - CVE-2020-12271 published to NVD
• 2025-11-07 - Last updated in NVD database

Technical Details for CVE-2020-12271

Vulnerability Analysis

This SQL injection vulnerability (classified as CWE-89) exists in the web-facing components of Sophos XG Firewall devices. The vulnerability is particularly dangerous because it requires no authentication to exploit and can be triggered remotely over the network. When either the administration interface (HTTPS service) or the User Portal is exposed to the WAN zone, attackers can submit specially crafted SQL queries through these interfaces.

The exploitation chain observed in the wild, referred to as "Asnarok" by Sophos, demonstrated sophisticated attack capabilities. Upon successful SQL injection, attackers were able to achieve remote code execution on affected devices, enabling them to extract sensitive credential data from the firewall's database. The exfiltrated data included usernames and hashed passwords for local device administrators, portal administrators, and user accounts used for remote access. Notably, external Active Directory and LDAP passwords were not affected by this vulnerability.

Root Cause

The root cause of CVE-2020-12271 is improper input validation and insufficient sanitization of user-supplied data in the SQL query construction process. The affected SFOS components failed to properly parameterize or escape input before incorporating it into database queries, allowing attackers to inject malicious SQL statements. This classic SQL injection pattern enabled attackers to manipulate database queries to extract unauthorized data and execute arbitrary commands on the underlying system.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no user interaction or authentication. Attackers can exploit this vulnerability remotely by sending specially crafted HTTP/HTTPS requests to the exposed administration interface or User Portal on the WAN zone. The attack leverages the SQL injection flaw to:

1. Bypass authentication mechanisms through query manipulation
2. Extract sensitive data directly from the database
3. Escalate the SQL injection to achieve remote code execution
4. Exfiltrate credentials including usernames and password hashes

The vulnerability was observed being exploited in active attacks during April 2020, with threat actors targeting organizations running vulnerable SFOS versions. Given the network-accessible nature of the attack surface and the potential for complete system compromise, this vulnerability posed an immediate threat to affected organizations.

Detection Methods for CVE-2020-12271

Indicators of Compromise

• Unusual outbound connections from Sophos XG Firewall devices to unknown external IP addresses
• Suspicious SQL error messages in firewall logs indicating injection attempts
• Unexpected database queries or data extraction activities in system logs
• Evidence of credential dumping or password hash exfiltration attempts
• Anomalous administrative login attempts following potential compromise

Detection Strategies

• Monitor HTTP/HTTPS traffic to the firewall's administration interface and User Portal for SQL injection patterns
• Review firewall logs for suspicious authentication failures or unexpected successful logins
• Implement intrusion detection rules to identify known Asnarok attack signatures
• Analyze network traffic for unusual data exfiltration patterns from firewall management interfaces

Monitoring Recommendations

• Enable comprehensive logging on Sophos XG Firewall administration interfaces
• Deploy network-based intrusion detection systems to monitor WAN-facing firewall services
• Implement log aggregation and SIEM correlation for firewall security events
• Regularly audit user accounts and password changes on affected devices

How to Mitigate CVE-2020-12271

Immediate Actions Required

• Update Sophos SFOS to a patched version released after April 25, 2020
• Restrict administration interface and User Portal access from the WAN zone
• Review and rotate all local administrator, portal admin, and remote access credentials
• Audit firewall configurations to ensure minimal external exposure
• Enable automatic updates to receive future security patches promptly

Patch Information

Sophos released an emergency hotfix on April 25, 2020, to address this critical vulnerability. Organizations should immediately apply the latest SFOS firmware updates available from Sophos. Detailed patch information and remediation guidance can be found in the Sophos Knowledge Base Article and the Sophos News Update on Asnarok. Additionally, this vulnerability is tracked in the CISA Known Exploited Vulnerabilities Catalog, which mandates remediation for federal agencies and provides guidance for all organizations.

Workarounds

• Disable WAN access to the administration (HTTPS) service immediately
• Disable WAN access to the User Portal if not strictly required
• Implement network segmentation to restrict access to firewall management interfaces
• Use VPN connections for remote administration instead of direct WAN exposure
• Apply firewall rules to limit access to management services to trusted IP addresses only

# Example: Restrict administration access to trusted networks only
# In Sophos XG Firewall web console:
# Navigate to Administration > Device Access
# Disable HTTPS and User Portal for WAN zone
# Enable access only for LAN and VPN zones
# Alternatively, create host group with trusted admin IPs
# Apply access restrictions in Local Service ACL