Sophos Web Protection Appliance sblistpack Command Injection Exploit

The /opt/ws/bin/sblistpack Perl script in Sophos Web Protection Appliance, which can be reached from the web interface, is vulnerable to an OS command injection because its get_referers() function does not escape the first argument of the script before using it within a string that will be executed as a command by using backticks. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary code in the affected appliance. The agent installed by this exploit runs with the privileges of the 'spiderman' user. After successfully installing an agent, by default this module will automatically run another module (Sophos Web Protection Appliance clear_keys.pl Privilege Escalation Exploit), which will try to exploit a privilege escalation vulnerability that is also present in the Sophos appliance in order to install another agent with root permissions.