CVE-2023-30802

Name of the Vulnerable Software and Affected Versions Sangfor Next-Gen Application Firewall version NGAF8.0.17

Description The issue is related to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid Content-Length field. This allows the attacker to access sensitive information.

Recommendations For Sangfor Next-Gen Application Firewall version NGAF8.0.17, consider restricting access to the HTTP endpoint that handles requests with the Content-Length field until a patch is available. As a temporary workaround, disabling the handling of invalid Content-Length fields may help mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.