CVE-2021-20020

published 2021-04-10

CVE-2021-20020: A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.

Priority P2 68 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
sonicwall	global_management_system	—	—
sonicwall	global_management_system	—	—
sonicwall	gms	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /var/lib/infobright_pg/pg_data/pg_hba.conf↗

path /etc/ld.so.preload↗

filename sgms-rce.py↗

filename pwn.so↗

filename lpe.so↗

path /var/lib/infobright_pg/pg_data/base↗

path /var/lib/infobright_pg/pg_data/pg_xlog↗

command psql -h <target> -p 5029 -U postgres -c "SELECT version()"↗

process linux/postgres/postgres_payload↗

bytes↗

\x7fELF|.got|.plt|.shstrtab|.dynamic|.text|.init|mmap|mprotect|memcpy|dup2|libc.so.6

• → Detect unauthenticated connections to PostgreSQL on port 5029/tcp from external/untrusted hosts; pg_hba.conf configured with 'trust' authentication for all addresses (0.0.0.0/0) is the root cause. ↗
• → Alert on creation or modification of /etc/ld.so.preload by the postgres user, which is the privilege escalation mechanism used to achieve root. ↗
• → Monitor for ELF binary artifacts (shared objects) written into PostgreSQL data directories (/var/lib/infobright_pg/pg_data/base or pg_xlog); grep for ELF headers and common ROP/shellcode strings as an indicator of postgres_payload delivery. ↗
• → Alert on /bin/ping being spawned as a child process of the postgres process; this is the execution vector used by the exploit's shared-object preload technique. ↗
• → Detect any file creation under /etc by the postgres user (uid=104), as the world-writable /etc directory is abused to drop ld.so.preload for privilege escalation. ↗
• → Monitor disk-level writes by the postgres process to detect payload staging in PostgreSQL data directories. ↗

• · The vulnerable version is GMS 9.3.9314; the fix is GMS 9.3 MAR-22474.1-HotFix released 2021-04-07. Ensure the hotfix is applied. ↗
• · The PostgreSQL instance uses 'trust' authentication for all hosts on all databases, meaning no password is required to connect as any user including postgres; network-level blocking of port 5029/tcp from untrusted hosts is a critical compensating control. ↗
• · The /etc directory is world-writable (drwxrwxrwt), which is the prerequisite for the local privilege escalation to root via ld.so.preload; this is an abnormal filesystem permission that should be audited. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287