[FD] [0day-Rubbish] SonicWall SMA 1000 — Pre-Auth Deserialization RCE (CVSS 9.8) via Struts 1 Property Injection and Auth-Filter Rewrite

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

Full-Disclosure List,

An unauthenticated remote code execution vulnerability chain in SonicWall SMA 
1000 series appliances is being disclosed here. The chain yields code execution 
as the `mgmt-server` user (uid=1011) on the management plane, with no 
credentials and no prior knowledge of the appliance beyond a reachable address.

A full technical writeup with a reproducible proof-of-concept is published at:

  https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce

Repository (advisory + PoC):

  https://github.com/Exploit-Garbage/0day-Rubbish

-----------------------------------------------------------------
1. Summary
-----------------------------------------------------------------

A four-stage pre-auth chain combines a Struts 1 property-injection
flaw, an in-memory Jetty authentication-filter rewrite, an unauthenticated
SSO Primary-Administrator token issuance, and a Java deserialization sink.
The result is unauthenticated RCE as `mgmt-server` (uid=1011).

CVSS 3.1 base: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Vector: network, low complexity, no privileges, no user interaction.

-----------------------------------------------------------------
2. Affected product
-----------------------------------------------------------------

Vendor:  SonicWall
Product: SMA 1000 series (Secure Mobile Access)
Firmware: 12.4.x line (verified on a 12.4 build; other 12.x lines
          may share the Struts 1 / Jetty console stack — not all
          were independently tested).
Component: /Console management plane, Central Management Service (CMS),
           /configUserCommunityEPC.do

-----------------------------------------------------------------
3. Vulnerability details
-----------------------------------------------------------------

Stage 1 — Authentication bypass via Struts 1 property injection
  Every Struts 1 ActionForm exposes a `multipartRequestHandler`
  property. By walking the bean graph
  (`servletContext -> servletHandler -> filterMappings`) an
  unauthenticated caller can rewrite the Jetty authentication
  filter's pathSpecs to a non-existent path and force the filter
  cache to rebuild. The entire `/Console` API and console actions
  become reachable without authentication.

Stage 2 — Enable Central Management Service
  With `/Console` unauthenticated, Central Management Service (CMS)
  can be enabled from the console API, preparing the SSO token path.

Stage 3 — Unauthenticated SSO Primary Admin token
  GET /Console/CentralManagement/SSO/Authorize?user=admin&roleUser=Primary+Admin
  returns a Primary Administrator token without any password. The
  token is exchanged for a valid JSESSIONID. The attacker is now the
  Primary Administrator, fully unauthenticated.

Stage 4 — Java deserialization RCE
  The `storedCommunity` field of `/configUserCommunityEPC.do` is
  consumed by a setter that calls `ObjectInputStream.readObject()`
  on attacker-controlled input. A `BeanComparator` + `TemplatesImpl`
  gadget chain is delivered through this field. The command executes
  as `mgmt-server` (uid=1011). Output is written to the webroot and
  read back via an anonymous GET.

-----------------------------------------------------------------
4. Impact
-----------------------------------------------------------------

- Unauthenticated remote code execution as `mgmt-server`.
- Full compromise of the SMA 1000 management plane.
- The appliance terminates remote-access VPN sessions; compromise
  of the management plane can be leveraged to pivot into the
  protected internal network and to intercept or reset VPN sessions.
- No credentials, no user interaction, no prior appliance knowledge
  beyond a reachable HTTPS address.

-----------------------------------------------------------------
5. Proof of concept
-----------------------------------------------------------------

A reproducible PoC is included in the repository under
`product/sonicwall/sma-12.4/preauth-deserialization-rce/exploit`.
The full chain and reproduction steps are documented in the advisory
URL above. The PoC contains no operator-identifying information and
targets placeholder hosts.

-----------------------------------------------------------------
6. Disclosure timeline
-----------------------------------------------------------------

- 2026-07-26: Technical writeup + PoC published to the project
              site and repository.
- 2026-07-27: This Full-Disclosure submission.

Vendor contact: SonicWall PSIRT was notified (cc'd). A coordinated
embargo was not requested by the operator prior to publication; this
submission is made in parallel with public availability of the
writeup.

-----------------------------------------------------------------
7. Credits
-----------------------------------------------------------------

Discovered and documented by the 0day-Rubbish independent
vulnerability-research project.

-----------------------------------------------------------------
8. References
-----------------------------------------------------------------

- Advisory: 
https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce
- Repo:     https://github.com/Exploit-Garbage/0day-Rubbish

--
0day-Rubbish
disclosure@xxxxxxxxxxxxxxxx
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/