Critical SonicWall Firewall is Under Active Attack: Immediate Patching Required

Threat actors are actively exploiting a critical authentication bypass vulnerability (CVE-2024-53704) in SonicWall firewalls, posing a significant risk to organizations relying on these devices for network security. This flaw, recently assigned a critical severity rating by CISA, resides within the SSLVPN authentication mechanism of SonicOS, affecting a range of SonicWall firewalls. The vulnerability is being targeted shortly after the public release of proof-of-concept (PoC) exploit code, escalating the urgency for immediate action.

Impact of CVE-2024-53704

The vulnerability impacts the following SonicOS versions:

• 7.1.x (up to 7.1.1-7058)
• 7.1.2-7019
• 8.0.0-8035

These versions are utilized across multiple Gen 6 and Gen 7 firewall models, as well as SonicWall's SOHO series devices. Successful exploitation of CVE-2024-53704 allows remote, unauthenticated attackers to hijack active SSL VPN sessions. This bypassesMulti-Factor Authentication (MFA) and grants them unauthorized access to internal networks, potentially leading to:

• Data breaches: Exfiltration of sensitive corporate data.
• Ransomware attacks: Encryption of critical systems and data extortion.
• Business disruption: Interruption of essential services and operations.
• Private Information Disclosure: Exposure of sensitive VPN session details.

Urgency and Mitigation

SonicWall issued an urgent advisory and released security updates on January 7th to address CVE-2024-53704. The company strongly advises all customers using affected SonicOS versions to immediately upgrade their firewall firmware to the latest patched versions.

For organizations unable to apply patches immediately, SonicWall has provided interim mitigation steps:

• Restrict Access by Source: Limit SSL VPN access to only trusted IP addresses or networks.
• Disable Internet Access: If SSL VPN is not essential, temporarily disable access from the internet entirely.

Exploitation in the Wild Confirmed

Cybersecurity firm Arctic Wolf has confirmed active exploitation attempts in the wild, commencing shortly after the PoC exploit was publicly released on February 10th by Bishop Fox. Internet scans conducted on February 7th revealed approximately 4,500 unpatched SonicWall SSL VPN servers exposed online, highlighting the extensive attack surface.

Arctic Wolf emphasizes the ease of exploitation and the readily available PoC, urging organizations to prioritize patching: "Given the ease of exploitation and available threat intelligence, Arctic Wolf strongly recommends upgrading to a fixed firmware to address this vulnerability."

Past Threats and Future Risks

SonicWall firewalls have been previously targeted by ransomware groups like Akira and Fog. Arctic Wolf reported in October that numerous intrusions originated from exploiting SonicWall VPN accounts, underscoring the critical need for robust security measures and timely patching. The public availability of a PoC exploit for CVE-2024-53704 significantly elevates the risk of widespread exploitation and potential large-scale attacks.

Recommendations for DevOps and Security Teams:

• Immediate Patching: Prioritize patching SonicWall firewalls to the latest SonicOS firmware versions.
• Vulnerability Scanning: Conduct thorough vulnerability scans to identify and remediate exposed systems.
• Implement Mitigation Measures: If patching is delayed, implement SonicWall's recommended mitigation steps.
• Enhanced Monitoring: Increase monitoring and logging for unusual VPN activity and potential intrusion attempts.
• Security Awareness: Reinforce security best practices and the importance of timely patching with all personnel.

Take Immediate Action to Secure Your SonicWall Firewalls. The risk of exploitation is critical, and proactive patching is the most effective defense against CVE-2024-53704.