SonicWall firewall exploit lets hackers hijack VPN sessions, patch now

Security researchers at Bishop Fox have published complete exploitation details for the CVE-2024-53704 vulnerability that allows bypassing the authentication mechanism in certain versions of the SonicOS SSLVPN application. The vendor warned about the high exploitation possibility of the flaw in a bulletin on January 7, urging administrators to upgrade their SonicOS firewalls' firmware to address the problem. "We have identified a firewall vulnerability that is susceptible to actual exploitation for customers with SSL VPN or SSH management enabled, and that should be mitigated immediately by upgrading to the latest firmware," warned SonicWall in an email sent to customers at the time. The flaw allows a remote attacker to hijack active SSL VPN sessions without authentication, granting them unauthorized access to the victim's network. On January 22  Bishop Fox researchers announced that they had developed an exploit for CVE-2024-53704 after a "significant reverse-engineering effort," confirming SonicWall's fears about the exploitation potential of the vulnerability. After allowing some time for system administrators to apply the available patches, Bishop Fox released the full exploitation details on Monday. The exploit works by sending a specially crafted session cookie containing a base64-encoded string of null bytes to the SSL VPN authentication endpoint at '/cgi-bin/sslvpnclient.' This triggers an incorrect validation of the session, as the mechanism assumes that the request...