SonicWall Flaw Lets Attackers Slip Past SAML Multifactor Checks on VPN Logins

According to the Cloud Security Alliance, SonicWall published an advisory on November 6 covering seven SonicOS vulnerabilities, and one of them is already under suspected exploitation. The flaw lets a user who holds valid credentials for a login method other than SAML get around SAML controls on the SSL VPN, including multifactor checks enforced through SAML. It is not an unauthenticated bypass, but it makes stolen passwords far more dangerous. CISA added it to its exploited vulnerabilities list the same day with a federal deadline of November 20, and SonicWall says no workaround exists. Fixed builds are available for Gen7 and Gen8 firewalls. Admins should also disable SSL VPN for local, LDAP, and RADIUS accounts that do not need it and rotate credentials. For more, visit the Cloud Security Alliance.