Watchtowr Labs

The Sangfor Next-Gen Application Firewall is affected by an operating system command injection issue. A remote, unauthenticated attacker can execute arbitrary commands by sending a specially crafted HTTP POST request to the `/cgi-bin/login.cgi` endpoint. This is due to improper handling of shell meta-characters within the `PHPSESSID` cookie. The vulnerability allows for remote code execution.

The issue is related to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid `Content-Length` field. This allows the attacker to access sensitive information.

The issue allows a remote and unauthenticated attacker to bypass authentication and access administrative functionality. This is achieved by sending HTTP requests with a crafted `Y-forwarded-for` header. The vulnerability is related to an authentication bypass, which can be exploited using specially formed HTTP requests.

The issue is related to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the "svpn html/loadfile.php" endpoint. This can be exploited by a remote and unauthenticated attacker under certain conditions. The vulnerability is associated with a lack of protection for service data, which can allow a remote attacker to disclose protected information.

The issue is related to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the "/LogInOut.php" endpoint. This vulnerability is due to the mishandling of shell meta-characters in the `un` parameter.