Authentication Bypass RCE in Sophos Firewall User Portal and Webadmin

This repository provides a proof-of-concept (POC) exploit for CVE-2022-1040, an authentication bypass vulnerability in the Sophos Firewall web admin interface. The repository contains two main Python files (Sophos-poc.py and Docker/Sophos-poc.py, which are identical), a Dockerfile for containerized execution, and a README with usage instructions. The exploit works by running a local HTTPS man-in-the-middle (MITM) proxy (using baseproxy) on port 8788. The user configures their browser to use this proxy, and when attempting to log in to the Sophos Firewall's web admin interface (typically on port 4444), the proxy intercepts and modifies specific POST requests to /webconsole/Controller. It injects a crafted JSON payload that exploits the authentication bypass, potentially granting unauthorized access to the firewall's admin interface. The exploit does not provide a post-exploitation payload but demonstrates the vulnerability by allowing access without valid credentials. The Dockerfile enables easy setup of the required environment. No hardcoded IPs or external domains are present; the main fingerprintable endpoints are the local proxy and the targeted Sophos Firewall path.

This repository provides a proof-of-concept (PoC) exploit for CVE-2022-1040, an authentication bypass vulnerability in the Sophos XG115w Firewall version 17.0.10 MR-10. The exploit consists of two main files: 'CVE-2022-1040.txt', which documents the vulnerability details and provides a sample HTTP POST request to the /webconsole/Controller endpoint, and 'userportal', which contains a similar POST request targeting the /userportal/Controller endpoint. Both files demonstrate how an attacker can craft specific POST requests with manipulated parameters (notably the 'mode' and 'json' fields) to bypass authentication and gain unauthorized access to the firewall's management or user portal interfaces. The README.md provides a brief description and a screenshot reference. No executable code is present; the repository is documentation and PoC request samples for manual exploitation. The attack vector is network-based, requiring access to the firewall's web interfaces.