Dimension SQL Injection in Scheduled Report

Summary #

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.

Impact: An authenticated attacker holding report administration privileges (or an admin tricked via CSRF misuse of an authenticated session) can execute arbitrary stacked SQL statements against the backend database used by the Dimension logging/report scheduler. This SQL execution can be escalated to write a crafted session file to the Dimension WebUI session storage; triggering that session with a chosen session cookie causes the WebUI process to deserialize attacker-controlled data, resulting in remote code execution as the Dimension WebUI process user (wgadmin). Successful exploitation gives the attacker full compromise of the Dimension WebUI process, the ability to tamper with application sessions, read or write application-owned files, modify reporting/scheduled-task data, and potentially pivot toward connected logging and Firebox management workflows.