Sophos Firewall User Portal and Webadmin Code Injection Vulnerability

This strike exploits a Code Injection Vulnerability in Sophos Firewall. This vulnerability is due to improper validation of JSON keys submitted in the "json" parameter sent to the Controller endpoint. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successfully exploiting this vulnerability could result in remote code execution with privileges of the root user. *NOTE: While running this strike in one-arm mode, four files Test1, Test2, Test3 and Test4 will be created in the /tmp/ directory of the server.