CVE-2023-1671

What it actually does

This is a pre-authentication OS command injection vulnerability in the Sophos Web Appliance warn-proceed handler. A network-reachable attacker can send crafted HTTP requests that cause attacker-controlled input to be interpreted by the appliance as shell commands. Because exploitation requires no credentials, no user interaction, and has network attack complexity rated low, successful exploitation can result in arbitrary code execution on the appliance with the privileges of the vulnerable web application or related appliance processes. From there, an attacker may modify appliance configuration, read sensitive proxy/security data, deploy malware or web shells, create persistence, pivot to adjacent systems, or disrupt web-filtering operations.

Why it matters to the business

Compromise of a Sophos Web Appliance can expose web traffic, authentication-related data handled by the appliance, security policy configuration, and operational logs, while also giving attackers a foothold inside the network perimeter. The vulnerability is listed in CISA KEV, has a very high EPSS score, and is actively exploited in the wild, so unpatched internet-facing appliances should be treated as high-priority incident-response candidates rather than routine patching items. Organizations still running unsupported or older Sophos Web Appliance versions face elevated operational risk because a compromised appliance can affect web access, filtering, monitoring, and downstream trust in security controls.

How an attack unfolds

An attacker first identifies a Sophos Web Appliance exposed to the network, commonly by scanning for SWA web interfaces or characteristic appliance responses. The attacker then sends a specially crafted unauthenticated HTTP request to the warn-proceed functionality containing shell metacharacters or command-substitution syntax in a parameter processed by the vulnerable handler. The appliance fails to safely separate user input from operating-system command execution, causing the injected command to run. Initial commands are often lightweight probes such as whoami, id, uname, or network reachability tests, followed by payload retrieval using curl, wget, or similar tools. After code execution is confirmed, an attacker may deploy a web shell or script, establish outbound command-and-control, add persistence, inspect appliance configuration and logs, and use the appliance’s network position to support credential theft, traffic interception, lateral movement, or further internal reconnaissance. Because this vulnerability is in CISA KEV with active in-the-wild exploitation, historical exposure should be investigated even after patching.

How to fix it

Upgrade Sophos Web Appliance to version 4.3.10.4 or later. If the appliance cannot be upgraded immediately, remove it from internet exposure, restrict access to trusted management and user networks only, place it behind strict firewall or VPN controls, and monitor or block requests to the vulnerable warn-proceed functionality until remediation is complete. Because Sophos Web Appliance is an older product line, organizations should verify vendor support status and plan migration to a supported secure web gateway or equivalent product if long-term patch availability is limited. For any appliance that was exposed before patching, assume possible compromise and perform incident-response triage: preserve logs, review filesystem changes, rotate credentials that may have traversed or been stored on the appliance, validate configuration integrity, and rebuild from trusted media if compromise cannot be ruled out.

How to confirm the fix worked

Confirm the installed Sophos Web Appliance version is 4.3.10.4 or later through the appliance administration interface, package/version inventory, or vendor-supported command-line checks. Verify that unauthenticated access to the vulnerable warn-proceed path is no longer possible or that crafted command-injection characters are rejected or safely handled. From network controls, confirm the appliance is not exposed directly to the public internet unless explicitly required and protected. Review vulnerability scanner results with an authenticated or version-based check where possible; unauthenticated banner checks alone may be unreliable. Validate that no unexpected scripts, modified web files, cron jobs, startup entries, new users, suspicious outbound connections, or unauthorized configuration changes remain after patching.

Typical attack path

1. Scan the internet or internal address ranges for Sophos Web Appliance interfaces.
2. Fingerprint the appliance version or test for the vulnerable warn-proceed handler.
3. Send an unauthenticated crafted HTTP request containing command-injection metacharacters or command-substitution syntax.
4. Execute a simple validation command such as id, whoami, uname, or a DNS/HTTP callback.
5. Use command execution to download and run a second-stage script, web shell, or remote access tool.
6. Establish persistence or recurring access through modified files, scheduled jobs, startup scripts, or appliance configuration changes.
7. Collect appliance configuration, logs, traffic metadata, credentials, or authentication artifacts accessible from the appliance.
8. Use the compromised appliance as an internal foothold for reconnaissance, proxying, lateral movement, or disruption of web-filtering services.

How to detect it

Investigate both exploitation attempts and successful post-exploitation activity. Primary log sources include Sophos Web Appliance web access logs, appliance application logs, web server error logs, system authentication logs, shell/process execution telemetry, EDR records if present, firewall flow logs, proxy logs, DNS logs, and outbound network telemetry. Search for unauthenticated HTTP requests referencing warn-proceed functionality, especially requests containing shell metacharacters such as semicolon, pipe, backticks, $(), URL-encoded command separators, or common command names. Pay close attention to requests followed by outbound HTTP, HTTPS, DNS, or TCP connections from the appliance to unfamiliar external hosts. On the appliance, review for web server child processes spawning /bin/sh, bash, curl, wget, python, perl, nc, or similar tools. Examine recent file modifications in web-accessible directories, temporary directories, startup scripts, cron locations, and appliance configuration paths. Also review admin logins and configuration changes occurring shortly after suspicious requests. Because active exploitation has been observed in the wild, absence of a known malware hash or static IOC should not be treated as proof of no compromise; behavioral evidence around command execution and outbound callbacks is more reliable.

• warn-proceed
• warn_proceed
• /warn-proceed
• %3B
• %7C
• %60
• %24%28
• ;id
• |id
• `id`
• $(id)
• ;whoami
• |whoami
• ;uname
• |uname
• /bin/sh -c
• /bin/bash -c
• curl http
• curl https
• wget http
• wget https
• nc -e
• bash -i
• python -c
• perl -e
• /tmp/
• /var/tmp/
• /etc/cron.d/
• /var/spool/cron/

What your security team should do

• Treat any unpatched Sophos Web Appliance older than 4.3.10.4 as an urgent exposure due to active exploitation, KEV listing, and near-certain EPSS exploitation likelihood.
• Patch or retire affected appliances immediately; if patching is not possible, isolate the appliance and block untrusted access to SWA web interfaces.
• Prioritize incident-response review for appliances that were internet-facing at any time before remediation, even if they are now patched.
• Search historical web, proxy, appliance, EDR, firewall, and DNS logs for unauthenticated requests to warn-proceed functionality and command-injection syntax.
• Look for post-exploitation behavior such as curl/wget execution, shell spawning by web server processes, new or modified web files, scheduled tasks, unknown outbound connections, and unusual DNS callbacks.
• Rotate credentials, API tokens, and administrative passwords that may have been stored on, proxied through, or entered into the appliance if compromise is suspected.
• Restrict appliance management and user-facing interfaces to necessary networks only, and alert on future direct exposure of SWA interfaces to the internet.
• If forensic integrity is uncertain, rebuild or replace the appliance from trusted installation media rather than relying only on in-place cleanup.