Sophos XG Firewall <= 17.5.12 RCE

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242169);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/17");

  script_cve_id("CVE-2020-15069");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/02/27");

  script_name(english:"Sophos XG Firewall <= 17.5.12 RCE");

  script_set_attribute(attribute:"synopsis", value:
"The remote Sophos XG Firewall may be affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks
feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2e882ea0");
  script_set_attribute(attribute:"solution", value:
"Apply Hotfix HF062020.1 or upgrade to SFOS v18");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-15069");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/06/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/06/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/16");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:sophos:xg_firewall_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Firewalls");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("sophos_xg_firewall_detect.nbin");
  script_require_keys("installed_sw/Sophos XG Firewall", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');
include('http.inc');

var app_name = 'Sophos XG Firewall';
var port = get_http_port(default:443);
var app_info = vcf::get_app_info(app:app_name, port:port, webapp:TRUE);

# Not checking hotfixes
if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var constraints = [
  {'max_version' : '17.5.12.99999', 'fixed_display' : 'Apply Hotfix HF062020.1 or upgrade to SFOS v18'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);