What is CVE-2022-1040 and how can I restore a vulnerable debugging environment for Sophos XG Firewall?
CVE-2022-1040 is an authentication bypass vulnerability in Sophos XG Firewall. To restore a vulnerable debugging environment locally after automatic updates have patched it, you must remount the filesystem as read-write with `mount -o remount,rw /`, then edit `/usr/share/webconsole/WEB-INF/web.xml` to remove the `RequestCheckFilter` filter that checks for invisible characters in JSON parameters. This is detailed in the Sophos XG Firewall Authentication Bypass Vulnerability (CVE-2022-1040) Exploitation Analysis.
CVE-2022-1040Sophos XG Firewallauthentication bypassdebugging environmentRequestCheckFilter