SonicWall has recently disclosed an authentication enforcement vulnerability in SonicWall’s SonicOS SSL-VPN service that allows an attacker with valid credentials to bypass authentication controls, including MFA.

Through this blog, we will understand what the vulnerability is about, the threat it poses, and what organizations should do.

About the vulnerability

The vulnerability arises due to a lack of sufficient enforcement of authentication in SonicOS SSL-VPN. It allows attackers with valid credentials for an alternative authentication method to bypass SAML authentication controls, including MFA enforced through SAML.

So, even if the SAML-based MFA is configured, an attacker can access the VPN without completing the authentication process.

What can an attacker do with this vulnerability?

By exploiting the flaw, an attacker can:

• Bypass MFA and circumvent SAML authentication using valid credentials for an alternative authentication method.
• Gain unauthorized VPN access and establish sessions without completing the intended SAML authentication.
• Access internal resources available to the compromised account.
• Use the VPN access as an entry point to move further into the network.
• Access or disclose sensitive information stored in internal systems.

Official security guidance

Recommended mitigation:

• Upgrade Gen 7 firewalls to SonicOS 7.3.4-7013 or later.
• Upgrade Gen 8 firewalls to SonicOS 8.2.3-8015 or later.
• Review SonicWall’s advisory for the applicable firewall model and firmware upgrade instructions.
• Verify that the SSL-VPN authentication configuration is secure after upgrading.

SharkStriker’s recommendations

We recommend that customers using SonicWall firewalls take the following actions:

• Identify affected devices: Verify whether your organization uses SonicWall Gen 7 or Gen 8 firewalls running vulnerable SonicOS firmware versions.
• Verify SSL-VPN configuration: Check whether SAML authentication is enabled for SSL-VPN logins, as the vulnerability specifically affects this configuration.
• Upgrade firmware: Immediately upgrade affected firewalls to the vendor-recommended fixed firmware versions.
• Review user accounts: Identify suspicious VPN sessions and validate whether the associated authentication activity was legitimate.
• Verify remediation: After upgrading, confirm that the firewall is running a fixed firmware version and that SAML-based MFA is being enforced correctly.

SharkStriker’s Actions

The following actions are recommended for the SharkStriker SOC team:

• Published a security advisory to inform customers about the vulnerability and its potential impact.
• Reviewed customer environments to identify SonicWall firewall deployments running affected SonicOS versions.
• Notified customers operating affected SonicWall firewalls and recommended immediate firmware upgrades.