CVE-2024-12727: Sophos Firewall Firmware SQLI Vulnerability

CVE-2024-12727 Overview

CVE-2024-12727 is a critical pre-authentication SQL injection vulnerability affecting the email protection feature of Sophos Firewall. This vulnerability exists in firmware versions older than 21.0 MR1 (21.0.1) and allows unauthenticated attackers to access the reporting database. When specific conditions are met—namely, Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode—this vulnerability can be escalated to achieve remote code execution on the affected system.

Critical Impact

Unauthenticated attackers can exploit this SQL injection to access sensitive data in the reporting database and potentially achieve remote code execution when SPX and HA mode are both enabled.

Affected Products

• Sophos Firewall Firmware versions prior to 21.0 MR1 (21.0.1)
• Sophos Firewall hardware appliances running vulnerable firmware
• Sophos Firewall deployments with SPX enabled and HA mode configured

Discovery Timeline

• 2024-12-19 - CVE-2024-12727 published to NVD
• 2025-11-12 - Last updated in NVD database

Technical Details for CVE-2024-12727

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists in the email protection feature of Sophos Firewall and requires no prior authentication to exploit. The flaw allows attackers to inject malicious SQL statements through user-controllable input that is not properly sanitized before being incorporated into database queries.

The vulnerability is particularly dangerous because it provides access to the reporting database, which likely contains sensitive operational data, logs, and configuration information. The attack surface is network-accessible, meaning any attacker who can reach the firewall's email protection interface can attempt exploitation.

What makes this vulnerability especially severe is the potential escalation path: when the firewall is configured with Secure PDF eXchange (SPX) enabled and operating in High Availability (HA) mode, successful SQL injection can be leveraged to achieve remote code execution. This configuration-dependent escalation transforms a data access vulnerability into a complete system compromise scenario.

Root Cause

The root cause of CVE-2024-12727 is improper input validation and sanitization in the email protection feature's database query handling. User-supplied input is incorporated into SQL queries without adequate parameterization or escaping, allowing attackers to manipulate query logic and inject arbitrary SQL commands.

The secondary issue enabling remote code execution relates to how the system processes certain operations when both SPX and HA mode are active, providing an exploitation path from database access to code execution.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication, no user interaction, and low attack complexity. An attacker can exploit this vulnerability by sending specially crafted requests to the email protection feature of an exposed Sophos Firewall.

The exploitation flow involves:

1. Identifying an exposed Sophos Firewall running a vulnerable firmware version
2. Sending malicious input containing SQL injection payloads to the email protection feature
3. Extracting sensitive data from the reporting database
4. If SPX and HA mode are enabled, escalating the attack to achieve remote code execution

The vulnerability mechanism involves unsanitized user input being concatenated directly into SQL queries. When an attacker provides input containing SQL metacharacters and malicious query fragments, the database engine interprets these as part of the legitimate query structure, allowing unauthorized data retrieval or manipulation. For detailed technical information, refer to the Sophos Security Advisory.

Detection Methods for CVE-2024-12727

Indicators of Compromise

• Unusual SQL error messages or database exceptions in firewall logs related to email protection services
• Unexpected queries or data access patterns in the reporting database audit logs
• Signs of unauthorized access to the reporting database or exported data
• Anomalous network traffic patterns targeting the email protection interface

Detection Strategies

• Monitor for SQL injection attack signatures in web application firewall (WAF) logs and IDS/IPS alerts
• Review Sophos Firewall logs for suspicious activity targeting the email protection feature
• Implement network traffic analysis to detect unusual query patterns or data exfiltration attempts
• Deploy SentinelOne to detect post-exploitation activities if RCE is achieved

Monitoring Recommendations

• Enable detailed logging on Sophos Firewall email protection components
• Configure alerts for failed authentication attempts and unusual database queries
• Monitor for unexpected process executions or network connections on firewall appliances
• Regularly audit HA cluster status and SPX configurations for unauthorized changes

How to Mitigate CVE-2024-12727

Immediate Actions Required

• Upgrade Sophos Firewall firmware to version 21.0 MR1 (21.0.1) or later immediately
• If immediate patching is not possible, consider temporarily disabling the email protection feature
• Review firewall configurations to identify systems running with both SPX and HA mode enabled
• Conduct a security audit to check for signs of prior exploitation

Patch Information

Sophos has released firmware version 21.0 MR1 (21.0.1) which addresses this vulnerability. Organizations should apply this update as soon as possible through their standard Sophos Firewall update process. Detailed patch information and update instructions are available in the Sophos Security Advisory.

Workarounds

• Restrict network access to the email protection feature using network segmentation and access control lists
• If SPX functionality is not required, disable the Secure PDF eXchange feature to eliminate the RCE escalation path
• Consider temporarily taking firewalls out of HA mode if SPX must remain enabled and patching is delayed
• Implement additional network-level monitoring and filtering for SQL injection attack patterns

# Configuration example: Verify current firmware version
# Access Sophos Firewall CLI and check firmware version
show version
# If version is below 21.0.1, schedule immediate update
# Verify SPX and HA configuration status
show configuration | grep -E "spx|high-availability"