SiteGuard WAF Vulnerability Enables Root Command Execution

A critical vulnerability in SiteGuard Server Edition, a Japanese-made web application firewall protecting over 1.5 million websites, allows attackers to execute system commands with root privileges. The flaw exists in the statistics feature, which is enabled by default on affected installations. Active exploitation has already been observed in the wild.

The vulnerability affects SiteGuard Server Edition versions 2.20 and later before 8.00 Update 5 on Apache httpd, Nginx, and IIS (excluding FreeBSD instances), as well as versions 2.20 and later before 7.00 Update 6 on FreeBSD. IIS versions 3.10 through 4.00 Update 4 are not vulnerable. The vendor has released patches and offers a file replacement solution for systems unable to upgrade immediately, including end-of-life versions.

The vendor warns that remediation may destroy evidence of compromise and recommends administrators preserve diagnostic information from the management interface before patching. Direct support customers received notification of the flaw on September 29.