CVE-2024-12727 in Sophos
Summary
by MITRE • 12/19/2024
A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/12/2025
This vulnerability exists within the email protection functionality of Sophos Firewall products, specifically affecting versions prior to 21.0 MR1. The flaw represents a critical pre-authentication sql injection vulnerability that enables unauthorized database access without requiring valid credentials. The vulnerability is particularly concerning because it operates at the database layer, allowing attackers to execute arbitrary sql commands against the reporting database that stores email protection logs and related information. The attack vector leverages the email protection feature which processes incoming email data and stores metadata in the database, creating an entry point for malicious sql payloads.
The technical exploitation requires a specific combination of conditions to achieve full remote code execution capabilities. When the Secure PDF eXchange (SPX) feature is enabled alongside the firewall operating in High Availability (HA) mode, the vulnerability becomes exploitable for remote code execution. This configuration creates a path where malicious sql injection can be escalated through database manipulation to system level commands. The vulnerability stems from insufficient input validation and sanitization within the email protection module, allowing attackers to inject sql commands that bypass normal security controls. The flaw aligns with CWE-89 which categorizes sql injection vulnerabilities as a critical weakness in application security, and represents a classic example of how improper data handling can lead to privilege escalation and system compromise.
The operational impact of this vulnerability extends beyond simple data theft or database manipulation. Attackers can potentially extract sensitive email data, user credentials, and system information stored in the reporting database. When combined with SPX and HA mode configurations, the vulnerability can enable full system compromise through remote code execution, allowing attackers to install malware, establish persistence, or escalate privileges within the network infrastructure. The vulnerability affects organizations that rely on Sophos Firewall for email protection, particularly those running older versions where patching may be delayed or constrained by operational requirements. The pre-authentication nature means that attackers can exploit this vulnerability without needing to establish a valid session, making it particularly dangerous in environments where network segmentation is not properly implemented.
Security teams should immediately implement network segmentation to limit access to affected systems and monitor for unusual database activity or sql injection attempts. The recommended mitigation involves upgrading to Sophos Firewall version 21.0 MR1 or later, which includes proper input validation and sql injection prevention measures. Organizations should also consider implementing database activity monitoring solutions to detect anomalous sql queries that may indicate exploitation attempts. The vulnerability demonstrates the importance of maintaining up-to-date security patches and implementing defense-in-depth strategies that include network segmentation, database access controls, and continuous monitoring. From an att&ck perspective, this vulnerability maps to techniques involving sql injection and remote code execution, with potential for lateral movement and privilege escalation within the network infrastructure. Organizations should also review their email protection configurations to ensure that unnecessary features like SPX are disabled when not required, reducing the attack surface and limiting the potential impact of such vulnerabilities.