---
title: "SonicWall File Upload (CVE-2021-20022)"
canonical: https://trickest.com/library/cve-2021-20022-sonicwall-email-security-file-upload
description: "Flag SonicWall Email Security hosts for CVE-2021-20022 by reading the version on GET /login.html. Floor band to 10.0.9.6177. No file upload."
---

# SonicWall File Upload (CVE-2021-20022)

## Overview

This workflow finds SonicWall Email Security and sorts each host by whether its version falls below the CVE-2021-20022 floor band. CVE-2021-20022 is unrestricted file upload on vulnerable Email Security builds. This check never uploads a file, never sends multipart, and never claims post-auth RCE. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/login.html`, fingerprints SonicWall Email Security from login-page markers, parses the version, and compares it to the floor band ending at 10.0.9.6177 in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). An affected row is a version signal only.

Run it on a schedule when email security appliances lag on maintenance builds. A host still below 10.0.9.6177 is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/login.html` on each host and fingerprint SonicWall Email Security from markers on that login page.
3. Parse the version and compare it to the CVE-2021-20022 floor band in the graph (through 10.0.9.6177).
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether SonicWall Email Security was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/login.html` only. No multipart upload and no post-auth RCE confirm.

## Sample output

The records below are illustrative and do not come from a real run. They show one Email Security host below the CVE-2021-20022 floor, one at or above it, and one host that is not the product.

```jsonl
{"url": "https://es.example.com", "is_product": true, "product_version": "10.0.9.6100", "vulnerable": true, "detail": "below floor band 10.0.9.6177"}
{"url": "https://es.example.org", "is_product": true, "product_version": "10.0.9.6177", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as SonicWall Email Security"}
```

```json
{"cve": "CVE-2021-20022", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which SonicWall Email Security versions does this flag?

Builds below the floor band through 10.0.9.6177 in the graph. The compare uses the version string the `/login.html` page itself served.

### Does an affected row mean a file was uploaded?

No. The check only GETs `/login.html` and reads the version. It does not send multipart, does not authenticate, and does not confirm post-auth RCE.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public login page. It does not upload a file.

### Does the check need credentials?

No. It fingerprints the public login page the way an external scanner would.

### What is CVE-2021-20022?

Unrestricted file upload in SonicWall Email Security on vulnerable builds. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [SonicWall SMA SSRF (CVE-2026-83548)](/library/sonicwall-sma1000-ssrf-check-cve-2026-83548). Reach for it when you need the SMA1000 SSRF check on later SonicWall gear.
- [Pulse Secure File Read (CVE-2019-11510)](/library/cve-2019-11510-pulse-connect-secure-file-read). Reach for it when you need another edge appliance arbitrary file read fingerprint.
- [NetScaler SD-WAN RCE (CVE-2017-6316)](/library/cve-2017-6316-citrix-netscaler-sdwan-rce). Reach for it when you need the Citrix SD-WAN / CloudBridge edge check.

---
_Markdown source of https://trickest.com/library/cve-2021-20022-sonicwall-email-security-file-upload._