CVE-2013-1359

Vulnerability

An authentication bypass vulnerability exists in Dell SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management Appliance (UMA) 5.1, 6.0, and 7.0; and ViewPoint 4.1, 5.0, 5.1, and 6.0 [1][2][3]. The flaw resides in the UMA interface at /appliance/ApplianceMainPage?skipSessionCheck=1 [2]. When the skipSessionCheck parameter is set, the application bypasses authentication checks, allowing unauthenticated access to the appliance management functionality [2]. This vulnerability is exploitable without any prior authentication or session tokens [2].

Exploitation

An attacker can exploit this vulnerability remotely by sending a crafted HTTP POST request to the vulnerable /appliance/ApplianceMainPage endpoint with the skipSessionCheck=1 parameter [2]. The attacker does not need any authentication, network position is only required to reach the management interface (typically exposed on TCP ports 80 or 443) [2]. The Metasploit module for CVE-2013-1359 combines this bypass with an arbitrary file upload to achieve code execution, but the bypass alone grants root (or SYSTEM) access [1][2]. No user interaction or race condition is required [2].

Impact

Successful exploitation allows a remote, unauthenticated attacker to gain root (on Linux) or SYSTEM (on Windows) privileges on the affected appliance [2]. The attacker can then execute arbitrary commands, upload or download files, and fully compromise the management server [1][2]. This bypass essentially provides complete control over the SonicWALL GMS/UMA/ViewPoint instance, potentially affecting all managed devices and configurations [2].

Mitigation

Dell SonicWALL has released security updates for this vulnerability; affected users should upgrade to the latest versions of Analyzer, GMS, UMA, and ViewPoint as specified in vendor advisories [2]. No workarounds are documented in the available references. If unable to patch immediately, restrict network access to the management interface (HTTPS/HTTP) to trusted IP addresses and consider placing the interface behind a VPN or firewall [2]. The vulnerability has been assigned CVE-2013-1359 and is listed in the Exploit Database [2].