Code Injection in SonicCloudOrg Sonic-Agent

Compliance Impact

This vulnerability allows unauthenticated remote code execution and unauthorized control over Sonic Cloud Platform agents, potentially leading to unauthorized access, data exfiltration, and manipulation of internal systems.

Such unauthorized access and potential data breaches can result in non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and strict access controls.

Because the vulnerability enables attackers to execute arbitrary commands and exfiltrate data without authentication, affected organizations may face risks related to data confidentiality, integrity, and availability, which are core requirements in these regulations.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-15497 is a critical unauthenticated command injection vulnerability in the Sonic Cloud Platform's sonic-server-controller component, affecting versions up to 2.7.2. The flaw exists in the /exchange/send endpoint, which bypasses JWT authentication due to the presence of the @WhiteUrl annotation. This allows unauthenticated attackers to send arbitrary JSON payloads to connected Agents via a Transport WebSocket channel.

Attackers can inject internal protocol messages such as runStep, which can execute arbitrary Groovy code on Agent hosts when combined with another unsandboxed execution vulnerability. This results in zero-authentication remote code execution with root privileges.

Attackers can enumerate Agent IDs through the open registration system and then send malicious payloads to control devices, execute operating system commands, exfiltrate data, or pivot to internal networks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized remote code execution as root on affected systems without any authentication.

Attackers can gain full control over devices running the vulnerable Sonic Cloud Platform, execute arbitrary OS commands, exfiltrate sensitive data, and move laterally within internal networks.

Because the vulnerability allows unauthenticated access, it significantly increases the risk of compromise, especially for publicly exposed Sonic instances.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized or unusual access attempts to the `/exchange/send` endpoint on Sonic Cloud Platform instances up to version 2.7.2.

Since the vulnerability allows unauthenticated attackers to send arbitrary JSON payloads via a WebSocket channel, detection can involve inspecting network traffic for suspicious JSON messages targeting this endpoint.

Commands to detect exploitation attempts might include using network monitoring tools like tcpdump or Wireshark to filter traffic to the `/exchange/send` endpoint, or using web server logs to identify requests with the `@WhiteUrl` annotation bypass.

• Use tcpdump to capture traffic on the relevant port and filter for WebSocket upgrade requests or JSON payloads targeting `/exchange/send`.
• Example tcpdump command: `tcpdump -i eth0 -A -s 0 'tcp port 80 or tcp port 443' | grep '/exchange/send'`
• Check web server or application logs for unauthenticated access attempts to `/exchange/send`.
• Use tools like FOFA or Shodan to identify publicly exposed Sonic instances that might be vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include removing the `@WhiteUrl` annotation from the `/exchange/send` endpoint to prevent unauthenticated access.

Enforce role-based authorization so that only ADMIN users can access this endpoint.

Implement validation of message types sent to the endpoint to prevent injection of malicious payloads.

Apply rate-limiting and logging on the `/exchange/send` endpoint to detect and block suspicious activity.

Since the affected products are no longer supported, consider isolating or decommissioning vulnerable Sonic Cloud Platform instances to reduce exposure.

Useful 0 Not Useful 0