What this checks: whether a SonicWall Email Security host runs a version affected by post-auth unrestricted file upload (RCE when chained with CVE-2021-20021). Read-only: it fingerprints SonicWall Email Security and reads the version, no exploitation.
3. Detection — reads the SonicWall Email Security version from the version exposed at /login.html, compares to 10.0.9.6177 (hardware appliance / ESXi virtual appliance); 10.0.9.6173 (Windows install and Hosted Email Security). Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your SonicWall Email Security URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds SonicWall Email Security and sorts each host by whether its version falls below the CVE-2021-20022 floor band. CVE-2021-20022 is unrestricted file upload on vulnerable Email Security builds. This check never uploads a file, never sends multipart, and never claims post-auth RCE. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /login.html, fingerprints SonicWall Email Security from login-page markers, parses the version, and compares it to the floor band ending at 10.0.9.6177 in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. An affected row is a version signal only.
Run it on a schedule when email security appliances lag on maintenance builds. A host still below 10.0.9.6177 is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /login.html on each host and fingerprint SonicWall Email Security from markers on that login page.
Parse the version and compare it to the CVE-2021-20022 floor band in the graph (through 10.0.9.6177).
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether SonicWall Email Security was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /login.html only. No multipart upload and no post-auth RCE confirm.
Sample output
The records below are illustrative and do not come from a real run. They show one Email Security host below the CVE-2021-20022 floor, one at or above it, and one host that is not the product.