AuthForce: SonicWall UTM SSO Forced Authentication: CVE-2020-5148

In the rapidly evolving landscape of cybersecurity, I have identified a glaring vulnerability in the globally used SonicWALL UTM Appliance and SSO Agent.

Today, I bring you CVE-2020-5148. Security Advisory - SNWLID-2021-0003

1. Introduction to the Software:

SonicWALL’s SSO Agent has been designed to offer a streamlined user experience. This feature enables a single sign-on, granting users access to an array of network resources. The level of access is determined by group memberships and the rules laid down by administrators.

For a more comprehensive understanding of the software, you can consult the official documentation here: SonicWALL SSO Overview

2. Technical Details:

• Affected Version: SonicWALL SSO Agent 4.1.10.0
• Tested on: Microsoft Windows Server 2012 R2 Standard
• Vulnerability Type: Forced Authentication
• CVSS Score: 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

Upon my analysis, I discovered that SonicWALL SSO Agent 4.1.10.0 is susceptible to a forced authentication vulnerability. Specifically, during the user’s authorization process, the SSO Agent makes an attempt to identify the active user by querying the workstation. This query uses either NETAPI or WMI protocols in its flow. The major oversight here is the lack of validation for the user workstation before initiating the NTLM authentication request.

Further deepening the concern, post a successful user authentication, the SSO Agent continues to poll the user’s workstation using NETAPI or WMI. It does so regardless of whether the source is verified, potentially leading to a full bypass of Access Control Lists (ACLs).

4. Implications of the Vulnerability:

It’s imperative to note that for the SSO Agent service to operate, it requires Administrator rights across all the associated workstations and server sites, typically referred to as Domain Admin. This poses a substantial risk, as any unauthorized entity trying to route web traffic through the UTM appliance can capture the password hash of this high-access account. Once this hash is in the wrong hands, it’s open to offline decryption or could be harnessed in various NTLM relay attacks.

My discovery emphasizes the paramount importance of constant vigilance in the realm of cybersecurity. By unveiling such vulnerabilities, the aim is to bolster defenses and stay a step ahead in the security game.

Figure 1: SSO Diagram Modified

Figure 2: Crossing the Network Boundary

Figure 3: Forced Authentication from SSO Workstation After Crossing Network Boundary

Figure 4: Relaying SSO Workstation to Extract Credentials from Another Host

Figure 5: Vulnerable SSO Agent Details

5. Remediation:

Directory Services Connector version 4.1.17 and earlier versions are affected. As a workaround if you cannot upgrade

• Use WMI client probing method to avoid this vulnerability
• Do not permit ‘administrator’ to login via the SSO agent service/DC server/exchange server/terminal server and ensure the administrator password meets applicable complexity best practices (at least 20 chars)

Directory Services Connector version 4.1.19 and higher versions are still affected but just come with a warning now.