CVE-2023-1671: Sophos Web Appliance command injection

CVE-2023-1671 is a pre-authentication command-injection vulnerability in the warn-proceed handler of Sophos Web Appliance (SWA). Sophos states that the flaw can allow arbitrary code execution and that SWA release 4.3.10.4 fixes it. The Sophos advisory says CISA observed exploitation in the wild. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on November 16, 2023, with a federal-agency due date of December 7, 2023.

This is now an end-of-life product problem as well as a patch problem. Sophos ended support for Web Appliance on July 20, 2023. A durable remediation plan must therefore verify the fixed release, remove untrusted reachability, assess the period of vulnerable exposure, and retire or replace every remaining SWA instance. Installing 4.3.10.4 is the documented CVE fix; it does not restore vendor support or prove that an exposed appliance was not compromised.

Evidence basis and limits

This recipe is based on the Sophos security advisory, Sophos lifecycle record, CISA KEV entry, live GHAD GHSA-5f37-m2hf-qphr, and NVD. Live GHAD has vulnerabilities empty. NVD CPE excludes 4.3.10.4, matching the vendor-named fix. Do not invent a later 4.3.10.5 floor. In its April 2023 advisory, Sophos said no customer action was required because updates were installed automatically by default. It also recommended protecting SWA with a firewall and keeping it inaccessible from the public Internet.

That automatic-update statement described the default behavior when the fix was published; it is not evidence that a particular appliance received 4.3.10.4. Sophos's current lifecycle page says SWA is unsupported, no longer receives updates, and may show update errors after July 20, 2023. Do not assume the automatic updater or an old update source remains operational. Inventory, version, network, and log evidence are still required. Public sources do not document a safe CVE-specific active test, so this recipe contains no request path, command payload, or exploit check.

When to use it

Use this recipe when inventory, a scanner, or an operator identifies a Sophos Web Appliance (physical, virtual, standby, or recovered) that may still be reachable or whose version is unknown. The durable outcome is isolation, verified 4.3.10.4 only when a provenance-checked Sophos artifact remains available, incident review of any untrusted-exposure window, and a named retirement plan for the EOL product.

Do not use it to probe warn-proceed, send a command-injection payload, or treat an automatic-update claim as proof the appliance is patched or clean.

Inputs

• Appliance inventory: hostname, environment, form factor, HA/standby copies, snapshots, and owner.
• Version evidence from an authorized operator or management interface, not from an unauthenticated probe.
• Historical and current network reachability for the management and proxy listeners.
• Update provenance if 4.3.10.4 is still installable, plus rollback and replacement-owner evidence.
• Log-retention coverage for any period of untrusted reachability.

Affected and fixed state

Appliance state	CVE-2023-1671 disposition	Required action
SWA without verified 4.3.10.4, or version unknown	Treat as affected	Isolate from untrusted networks, preserve evidence, and retire or replace; use the fixed release only when a provenance-verified Sophos update remains available
SWA 4.3.10.4 with verified update evidence	Contains the vendor-documented fix	Assess earlier exposure and retire the unsupported appliance
No SWA present, with complete asset and traffic evidence	Finding may be not applicable	Record the evidence and responsible owner

Do not clear the finding from a desired-state declaration, an update-policy setting, or one node in a redundant deployment. Capture the running version of every physical appliance, virtual appliance, standby node, snapshot, template, and disaster-recovery copy.

How to determine exposure safely

1. Identify all SWA instances from CMDB, virtualization, network, DNS, proxy, certificate, firewall, backup, and disaster-recovery records.
2. Capture the running SWA version from the authenticated management interface or an approved inventory system. Record the appliance identity, serial or VM identifier, role, timestamp, and evidence source.
3. Confirm whether the appliance's update history proves installation of 4.3.10.4. The historical default automatic-update setting is not evidence that the update completed, and the current EOL product no longer receives updates from Sophos.
4. Map every path by which an untrusted client could reach the appliance during the vulnerable period, including public NAT, proxy paths, VPNs, guest or partner networks, and compromised internal clients.
5. Preserve the relevant SWA, firewall, proxy, DNS, authentication, EDR, and virtualization logs before retention or maintenance changes them.

Do not send a crafted request to the warn-proceed handler. A safe exposure decision comes from version and reachability evidence, not exploit validation.

Immediate containment

For an affected or unknown appliance with untrusted reachability, prepare an operator-approved change that blocks public and other untrusted access at the closest reliable firewall, load balancer, proxy, or network control. Record the rule, time, owner, affected traffic, expiry, and restoration criteria.

Sophos lists no workaround. This isolation follows its exposure-reduction recommendation, but it is not a product workaround or fix, and isolation now does not erase historical exposure. Notify the incident-response owner when an affected appliance was reachable, logs are incomplete, or suspicious activity exists. Preserve evidence before restarting, rebuilding, deleting files, rotating credentials, or changing log settings.

How to remediate CVE-2023-1671

1. Establish the service owner, incident-response owner, maintenance window, and authority for each appliance.
2. If an appliance does not have verified 4.3.10.4, keep it isolated while the owner determines whether the organization retains a provenance-verified Sophos-supplied update or recovery artifact. Do not rely on the EOL appliance's updater, use a mirror or third-party package, or imply that Sophos still supplies SWA updates.
3. Back up only through the organization's established SWA recovery process. Keep forensic evidence separate from operational backups.
4. When an authorized owner has a provenance-verified Sophos artifact and a tested recovery plan, install and verify 4.3.10.4 on every in-scope node before restoring any permitted path. Keep stale snapshots, templates, and standby appliances from re-entering service. Treat this only as interim risk reduction on an unsupported product.
5. Create a dated retirement or migration change with a named owner. Replace SWA with a supported web-security control, validate policy equivalence and logging, migrate traffic in stages, and remove the unsupported appliance from routing, DNS, monitoring, backup, and recovery inventories.

If a provenance-verified Sophos update is unavailable, keep the appliance isolated and escalate discontinuation and replacement. CISA's current KEV action is to apply vendor mitigations or discontinue use when mitigations are unavailable. Sophos's lifecycle page directs remaining customers to its migration information and a Sophos partner for a supported replacement path.

How to verify remediation

• Capture the running version 4.3.10.4 from every appliance and attach the evidence to the change record.
• Confirm update completion rather than relying only on the automatic-update configuration.
• Confirm public and other untrusted paths remain closed until both patch and incident-response decisions are complete.
• Run ordinary, authenticated proxy and policy health checks with benign test traffic. Do not exercise the vulnerable handler with attacker-controlled input.
• Verify that standby nodes, VM templates, snapshots, backups, and recovery procedures cannot restore an earlier release.
• Track the EOL retirement change separately; a fixed version does not make the platform supported.

When historical exposure existed, let incident response determine the required log review, credential rotation, rebuild, or other eradication work. Absence of an obvious indicator is not proof that exploitation did not occur.

Agent prompt

You are remediating exactly CVE-2023-1671 in a Sophos Web Appliance estate.
Return either a reviewer-ready change set or TRIAGE.md.

1. Inventory every active, standby, virtual, snapshot, template, backup, and
   disaster-recovery copy. Record the running version and evidence source.
2. Map historical and current untrusted reachability without sending an active
   probe or crafted request.
3. If 4.3.10.4 is not verified, prepare owner-approved isolation, backup,
   rollback, and per-node verification. Use an update only when it is a
   provenance-verified Sophos artifact; otherwise escalate discontinuation and
   migration because the EOL appliance no longer receives updates.
4. Preserve logs and hand exposed or uncertain systems to incident response.
   Do not claim that patching proves no compromise.
5. Create a named, dated migration or retirement action because SWA reached
   end of life on 2023-07-20.

Do not execute an exploit, scan public systems, alter production network state,
restart an appliance, delete evidence, rotate credentials, or deploy an update
without the responsible owner's approval. Do not download software from a
third-party source.

Stop with TRIAGE.md when the version, fleet scope, update provenance, exposure
history, logs, rollback, ownership, or replacement path cannot be proven.
TRIAGE.md must name the missing evidence, affected assets, current containment,
responsible owner, and next authorized decision.

Rollback and stop conditions

Rollback must use the approved SWA recovery procedure and recorded pre-change state. Do not restore an affected release to an untrusted network. If an update must be rolled back, maintain isolation and escalate replacement immediately.

Stop and write TRIAGE.md when:

• any appliance identity, running version, standby copy, or historical network path is unknown;
• the official 4.3.10.4 update or its provenance cannot be verified;
• logs do not cover an affected period of untrusted reachability;
• suspicious activity or an integrity discrepancy is found;
• production isolation, update, migration, or retirement lacks an authorized owner; or
• verification would require exploit-like traffic.

Output contract

Return one reviewer-ready change scoped to CVE-2023-1671, or TRIAGE.md. The change must include fleet inventory, before/after versions, update provenance, historical reachability, evidence-preservation disposition, safe health checks, rollback, residual risk, and a named EOL retirement owner and date. Never claim remediation from configuration intent alone.

Primary references

• Sophos Web Appliance 4.3.10.4 security advisory
• GitHub Advisory GHSA-5f37-m2hf-qphr
• Sophos product lifecycle
• CISA Known Exploited Vulnerabilities entry
• NVD record for CVE-2023-1671

Related workflow

• CVE Intelligence Intake Gate
• How to remediate vulnerabilities with AI agents