CVE-2023-30806

Deeper analysis

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 contains an operating system command injection vulnerability (CWE-78) in the /cgi-bin/login.cgi endpoint. The flaw stems from improper handling of shell metacharacters within the PHPSESSID cookie value, allowing unauthenticated remote attackers to inject and execute arbitrary operating system commands via crafted HTTP POST requests. The issue carries a CVSS 3.1 score of 9.8, reflecting network-accessible, low-complexity exploitation with no required credentials or user interaction.

A remote unauthenticated attacker can send a malicious POST request containing shell metacharacters in the PHPSESSID cookie to achieve arbitrary command execution on the affected firewall appliance. Successful exploitation grants the attacker full control over the device, enabling actions such as data exfiltration, persistence, or lateral movement within the protected network.

EPSS scores for this CVE rose from a low baseline to a peak of 0.1704 (current value 0.1485), indicating emerging exploitation interest after public disclosure. Public analyses from WatchTowr Labs and VulnCheck have detailed the request construction required to trigger the flaw.