What is CVE-2022-1040 and how can I restore a vulnerable debugging environment for Sophos XG Firewall?

Question

Onedaysec · Accepted Answer

CVE-2022-1040 is an authentication bypass vulnerability in Sophos XG Firewall. To restore a vulnerable debugging environment locally after automatic updates have patched it, you must remount the filesystem as read-write with `mount -o remount,rw /`, then edit `/usr/share/webconsole/WEB-INF/web.xml` to remove the `RequestCheckFilter` filter that checks for invisible characters in JSON parameters. This is detailed in the [Sophos XG Firewall Authentication Bypass Vulnerability (CVE-2022-1040) Exploitation Analysis](/news/sophos-xg-firewall-authentication-bypass-vulnerability-cve-2022-1040-exploitation-analysis).