CVE-2021-20051: SonicWall Global VPN Client RCE Vulnerability

CVE-2021-20051 Overview

CVE-2021-20051 is a DLL Search Order Hijacking vulnerability affecting SonicWall Global VPN Client version 4.10.7.1117 and earlier. Both 32-bit and 64-bit installer components are vulnerable to this attack, which allows a local attacker to execute arbitrary commands on the target system by placing a malicious DLL in a location searched by the vulnerable installer component.

Critical Impact

Successful exploitation of this vulnerability enables local attackers to achieve command execution on vulnerable systems, potentially leading to complete system compromise, privilege escalation, or lateral movement within enterprise networks.

Affected Products

• SonicWall Global VPN Client 4.10.7.1117 (32-bit installer)
• SonicWall Global VPN Client 4.10.7.1117 (64-bit installer)
• SonicWall Global VPN Client versions prior to 4.10.7.1117

Discovery Timeline

• 2022-05-04 - CVE-2021-20051 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-20051

Vulnerability Analysis

This vulnerability falls under the DLL Injection vulnerability category (CWE-427: Uncontrolled Search Path Element). The flaw exists in the installer components of SonicWall Global VPN Client, where the application fails to properly validate or restrict the search path used when loading Dynamic Link Libraries (DLLs).

When the installer executes, Windows follows a predetermined search order to locate required DLLs. If the installer does not specify an absolute path or implement secure DLL loading practices, an attacker can place a malicious DLL with an expected name in a location that is searched before the legitimate DLL location. This allows the attacker's malicious code to be loaded and executed with the privileges of the installer process.

The vulnerability requires local access and user interaction, as the attacker must either place the malicious DLL before the victim runs the installer or convince the user to run the installer from a directory containing the malicious DLL.

Root Cause

The root cause of CVE-2021-20051 is the installer's failure to implement secure DLL loading practices. Specifically, one of the installer components does not use fully qualified paths when loading DLLs and does not restrict the DLL search path to trusted directories. This allows the Windows loader to search for DLLs in potentially attacker-controlled locations, such as the current working directory, before checking system directories where legitimate DLLs reside.

Attack Vector

The attack is executed locally and requires the following conditions:

1. The attacker must have local access to the target system or the ability to place files on the system (e.g., through a network share or email attachment)
2. The attacker creates a malicious DLL with a name matching one of the DLLs expected by the vulnerable installer component
3. The malicious DLL is placed in a directory that appears earlier in the Windows DLL search order (such as the same directory as the installer or the current working directory)
4. When the victim runs the installer, it loads the malicious DLL instead of the legitimate one
5. The malicious code within the DLL executes with the same privileges as the installer process

This attack vector is particularly concerning in enterprise environments where VPN client installers may be deployed from shared network locations that could be compromised by attackers who have already gained limited access to the network.

Detection Methods for CVE-2021-20051

Indicators of Compromise

• Presence of unexpected DLL files in the same directory as the SonicWall Global VPN Client installer
• Suspicious DLL files with names matching common Windows system libraries in non-standard locations
• Unexpected processes spawned during or shortly after VPN client installation
• Anomalous network connections originating from installer processes

Detection Strategies

• Monitor file creation events in directories where the SonicWall installer is stored or executed, particularly looking for newly created DLL files
• Implement application whitelisting to prevent unauthorized DLLs from being loaded
• Use Sysmon or similar endpoint monitoring tools to track DLL load events, focusing on DLLs loaded from unexpected paths during installation
• Deploy behavioral detection rules that identify installer processes loading DLLs from writable or user-controlled directories

Monitoring Recommendations

• Enable enhanced process and module load logging on endpoints where VPN software installations occur
• Configure security information and event management (SIEM) solutions to alert on DLL side-loading patterns during software installation
• Implement file integrity monitoring on network shares used for software deployment
• Review installation logs for any anomalies or unexpected module loads

How to Mitigate CVE-2021-20051

Immediate Actions Required

• Upgrade SonicWall Global VPN Client to the latest patched version as specified in the vendor advisory
• Verify the integrity of installer packages before deployment using cryptographic hashes provided by SonicWall
• Ensure installers are only executed from trusted, write-protected locations
• Restrict user permissions to prevent the placement of files in directories used for software installation

Patch Information

SonicWall has released a security advisory addressing this vulnerability. Organizations should review the SonicWall Vulnerability Advisory SNWLID-2021-0036 for detailed patch information and upgrade instructions. It is recommended to update to the latest version of SonicWall Global VPN Client that addresses this DLL Search Order Hijacking vulnerability.

Workarounds

• Run the installer from a clean, read-only directory that users cannot modify
• Use application control policies to prevent execution of installers from untrusted locations
• Deploy installers using enterprise software distribution tools that enforce integrity checks
• Temporarily restrict VPN client installations to IT administrators only until patched versions can be deployed across the organization

# Verify installer integrity before deployment
# Download official installer and verify hash against SonicWall's published values
certutil -hashfile SonicWallGlobalVPNClient-x64.msi SHA256

# Run installer from a clean, protected directory
# Ensure the directory has restricted write permissions
icacls "C:\SecureInstall" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"