CVE-2021-20022

What it actually does

CVE-2021-20022 is an arbitrary file upload vulnerability in SonicWall Email Security 10.0.9.x. A network-accessible attacker who has authenticated to the product with sufficient privileges can submit a crafted upload request that is not properly validated, allowing attacker-controlled files to be written to the server. If the uploaded file is placed in a web-accessible or executable location, this can lead to web shell deployment, remote code execution in the context of the SonicWall Email Security application, persistence, data access, and full compromise of the appliance or host.

Why it matters to the business

Compromise of an email security gateway can expose sensitive email content, credentials, mail routing data, quarantine contents, and security policy configuration. Because this vulnerability is listed in CISA KEV, has been exploited in the wild, and is associated with ransomware activity, affected SonicWall Email Security deployments should be treated as high-priority remediation targets even though exploitation requires authentication. A successful compromise can disrupt inbound and outbound mail flow, weaken phishing and malware filtering, enable further intrusion into the network, and support ransomware deployment or data theft.

How an attack unfolds

An attacker first obtains authenticated access to SonicWall Email Security, either by using stolen administrative credentials, abusing a separate authentication weakness, or leveraging an already-compromised account. The attacker then sends a crafted file upload request to the vulnerable SonicWall Email Security interface. Because the application does not adequately restrict the uploaded file type, name, path, or content, the attacker can place an arbitrary file on the server. In practical attacks, this may be used to upload a web shell or other executable payload. The attacker then accesses the uploaded file over HTTP/S or causes the application to execute it, gaining command execution or durable remote access. From that foothold, the attacker may collect email data and credentials, alter mail security settings, move laterally, stage additional tooling, or support ransomware operations. This vulnerability has known in-the-wild exploitation and was subject to a CISA KEV remediation deadline of 2021-11-17.

How to fix it

Upgrade SonicWall Email Security and SonicWall Hosted Email Security to a vendor-supported fixed release or the latest available release. SonicWall published fixes for the 10.0.9.x branch; organizations still running 10.0.9.x should move to a fixed build such as 10.0.9.6173 or later where available, or to a current supported major release per SonicWall guidance. If immediate upgrade is not possible, restrict administrative and management interface access to trusted networks or VPN only, enforce MFA for administrative accounts where supported, rotate administrative credentials, remove unnecessary accounts, review upload-capable roles, and monitor for suspicious uploaded files. For hosted service customers, confirm with SonicWall that the hosted environment has been remediated. Because this vulnerability is KEV-listed and associated with ransomware activity, mitigation alone should be considered temporary.

How to confirm the fix worked

Confirm the deployed SonicWall Email Security version and build are no longer in the affected 10.0.9.x vulnerable range and are at a vendor-fixed or current supported release. Verify the management interface is not broadly exposed and that administrative access is limited to trusted sources. Conduct a controlled validation in a non-production or approved test environment to confirm the application rejects or safely stores executable file types, path traversal-style filenames, and web-executable extensions. Review file systems and web application directories for recently created or modified unexpected files. Confirm no suspicious administrator accounts, mail-routing changes, policy changes, or startup/persistence artifacts were introduced before or during remediation.

Typical attack path

1. Identify an internet-facing or otherwise reachable SonicWall Email Security instance running an affected 10.0.9.x build.
2. Obtain authenticated access through stolen credentials, password reuse, phishing, prior compromise, or chaining with another vulnerability.
3. Submit a crafted upload request that bypasses file validation controls.
4. Write an attacker-controlled file, such as a script, web shell, or executable payload, to the remote host.
5. Invoke the uploaded file or otherwise cause it to execute under the SonicWall Email Security application context.
6. Use the resulting access to run commands, collect email and configuration data, create persistence, disable defenses, or stage additional malware.
7. Expand the intrusion through credential theft, lateral movement, data exfiltration, or ransomware deployment.

How to detect it

Review SonicWall Email Security application, administrative audit, web access, operating system, and reverse proxy/WAF logs for evidence of authenticated file upload activity followed by requests to newly uploaded files. Focus on uploads by unfamiliar users, uploads from unusual source IP addresses, uploads outside maintenance windows, failed or unusual attempts involving executable extensions, and subsequent HTTP requests to the same filename. Examine the underlying host for recently created or modified files in SonicWall Email Security application, web root, upload, temporary, quarantine, and attachment-processing directories. Look for web shell characteristics such as small script files that execute commands, files with double extensions, recently modified JSP/ASP/ASPX/PHP/script files, and files containing command execution functions. Correlate with process telemetry for unexpected command interpreters, scripting engines, archive tools, network utilities, or security-disabling commands spawned by the SonicWall Email Security application or web server process. Because this vulnerability has been exploited in ransomware-related activity, also review for signs of lateral movement, credential dumping, abnormal outbound connections, new scheduled tasks/services, mass file access, and suspicious mail policy or forwarding changes.

• POST requests to SonicWall Email Security administrative or upload endpoints followed by HTTP 200/302 responses and subsequent GET requests for the uploaded filename
• Uploaded files with executable or web-script extensions: .jsp, .jspx, .asp, .aspx, .php, .war, .jar, .exe, .dll, .bat, .cmd, .ps1
• Double-extension uploaded filenames such as .jpg.jsp, .png.aspx, .txt.php, .gif.jsp
• Web shell command parameters in HTTP requests: cmd=, command=, exec=, shell=, powershell=, whoami, ipconfig, net user
• Unexpected child processes spawned by the SonicWall Email Security application or web server: cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe
• Suspicious script content strings in newly uploaded files: Runtime.getRuntime, ProcessBuilder, System.Diagnostics.Process, eval(request, assert($_POST, passthru($_REQUEST
• New or recently modified web-executable files in SonicWall Email Security application, web root, upload, temporary, quarantine, or attachment-processing directories

What your security team should do

• Patch or upgrade all affected SonicWall Email Security deployments immediately; prioritize internet-facing systems and any 10.0.9.x builds.
• Treat unpatched appliances as potentially compromised due to KEV status, active in-the-wild exploitation, and ransomware association.
• Restrict access to SonicWall Email Security administrative interfaces to trusted management networks and require strong authentication.
• Rotate SonicWall Email Security administrative credentials and investigate any unknown, stale, or unexpectedly privileged accounts.
• Review web directories, upload directories, temporary directories, and application directories for suspicious recently modified files or web shells.
• Search historical logs for unusual authenticated upload activity, especially from unfamiliar IP addresses or outside normal administrative windows.
• Hunt for post-exploitation activity such as unexpected child processes spawned by the application service, outbound connections from the appliance, abnormal mail policy changes, and credential access attempts.
• If compromise is suspected, isolate the appliance or host, preserve logs and disk artifacts, rebuild from trusted media or vendor image, and restore configuration only after review.