Hackers Exploit SonicWall SMA Zero-Days to Gain Root Access and Deploy ORANGETAIL Webshell

An ongoing exploitation of two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) devices. These vulnerabilities allowed a threat actor, identified as UTA0533, to gain root-level access, install persistent malware, and deploy the ORANGETAIL Java webshell on vulnerable VPN appliances.

The affected SonicWall SMA models include the 1000 series, specifically models 6210, 7210, and 8200. The earliest recorded compromise occurred in June 2022. SonicWall disclosed and patched these vulnerabilities on July 14, releasing fixes in SMA versions 12.4.3-03453 and 12.5.0-02835.

Hackers Exploit SonicWall SMA Zero-Days

The threat actors exploited a chained attack involving two vulnerabilities: CVE-2022-15409, a server-side request forgery flaw, and CVE-2022-15410, a command-injection vulnerability.

UTA0533 used these flaws to bypass authentication, access services intended only for localhost, execute commands as root, and establish covert access for network pivoting.

The intrusion began by exploiting the SMA /wsproxy endpoint. By sending a request with a bmID value starting with -3389 and using the SMA Connect Agent user agent, the attackers could create an unauthenticated WebSocket tunnel to internal services.

Volexity observed access to local CouchDB on port 1050 and the SMA control service on port 8181. Successful exploitations typically resulted in HTTP 101 Switching Protocols responses being logged by the appliances.

Reportedly, the attackers leveraged their access to CouchDB to create a malicious script under the low-privileged couchdb account. This script read the system’s product_uuid, which could then be used for authentication with the locally hosted XML-RPC control service.

The threat actor then invoked the vulnerable sysCtrl.execRemoveHotfix method, exploiting a path traversal vulnerability in the remove_hotfix helper to execute a file from /tmp with root privileges.

Volexity discovered evidence that attackers ran a staged script such as /tmp/1234.sh using a traversal payload like ../../../../../tmp/1234.sh.

The vulnerable helper failed to restrict the supplied path to its expected rollback directory, allowing an attacker-controlled file to be marked as executable and launched with elevated privileges.

After gaining root access, UTA0533 deployed several appliance-specific tools. One such tool was a setuid ELF binary named xzfind, referred to internally as ROOTRUN, which allowed for arbitrary command execution as root.

The actor also dropped a Python implant named deploy_new.py, tracked as KNUCKLEBALL, and configured it to run persistently from the legitimate /etc/init.d/workplace startup script.

KNUCKLEBALL injected two Java Archive payloads into SonicWall’s workplace.startup.CommandStartup process using the Java Attach API. One of these payloads contained a modified version of Suo5, an HTTP proxy-forwarding tool.

The other, ORANGETAIL, is a custom Java webshell that mimics the behavior of the Behinder framework. ORANGETAIL accepted encrypted payloads through a specific HTTP POST parameter and dynamically loaded attacker-provided Java classes, returning encrypted responses.

To obfuscate access to these payloads, the malware modified /var/lib/unit/conf.json, adding NGINX rewrite rules that redirected /__api__/login and /__api__/logout to malicious endpoints proxied to 127.0.0.1:8085.

Both implants required an unusual or invalid browser user-agent string to respond, thereby reducing their exposure to normal requests and passive scanning.

Post-compromise activities included attempts to pivot within victim networks and capture unencrypted LDAP traffic using tcpdump. Volexity also observed authentication attempts from infected SMA appliances to internal systems.

Over 200 source IP addresses were linked to the exploitation and webshell operations, including addresses associated with ExpressVPN and MullvadVPN infrastructure.

Administrators are urged to apply SonicWall’s hotfixes immediately, review logs such as /var/log/aventail/extraweb_access.log, access_servers.log, and ctrl-service.log for any suspicious /wsproxy activity, and investigate unexpected files in /tmp or /var/tmp.

Defenders should also inspect /var/lib/unit/conf.json for unauthorized routes, search for unapproved setuid binaries, and monitor SMA appliances for any unusual outbound or lateral connections.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.