Fortinet WAF allows remote code execution

Fortinet WAF allows remote code execution

Aug 25th 2021

A new exploit discovered in Fortinet’s Web application firewall (WAF) solution, FortiWeb, is currently vulnerable to command injection. The vulnerability, affecting versions 6.3.11 and prior, was discovered and reported by a Rapid7 researcher, William Wu. This type of attack has a CVSSv3 base score of 8.7.

The vulnerability requires authentication, but once authenticated, attackers can issue arbitrary commands on the system through the SAML interface as the root user. Wu noted in his writeup that whilst authentication is necessary, this vulnerability could be chained with another method of bypassing authentication (such as CVE-2020-29015), which allowed for blind SQL injection.

According to the writeup, the research into this exploit would allow an attacker to “take complete control of the affected device, with the highest possible privileges”. Wu has published a Proof of Concept (PoC) code showing the use of HTTP request smuggling, using backticks to smuggle the commands.

Unfortunately, the disclosure of this research seems to have occurred before Fortinet anticipated. Fortinet noted they had expected Rapid7 to hold any of their findings to the end of their 90-day responsible disclosure window.

However, Rapid7 operates a 60-day disclosure policy and chose to disclose this vulnerability after 60 days had passed. Fortinet has indicated that their latest update, FortiWeb 6.4.1, is expected to be released at the end of August and include a fix. The PoC code exists and no patch is available in the meantime. This provides limited options for defenders to protect Fortinet devices in the meantime.

In the interim, users should remove the FortiWeb device management interface from untrusted networks. Generally, any management interface will provide access to sensitive information and administrative functionality, and should not be exposed to reduce the likelihood of compromise. Access should only be possible via trusted, internal networks or over secure VPN.

Exchange-Exploit

New Exchange RCE vulnerability actively exploited

How effective is secure code review for discovering vulnerabilities?

How effective is secure code review for discoveri...

Application Security (AppSec)

Application Security (AppSec)

Dealing with Dependencies

Enhancing Security in your Software Development L...

Exchange Server Emergency Mitigation Service

Exchange Server Emergency Mitigation Service

VMware

VMware vCenter Critical RCE Vulnerability

OWASP

OWASP Top 10 2021 Released

Introduction to Windows 11 (Beta) Security

Introduction to Windows 11 (Beta) Security

HTTP/3 and QUIC: A new era of speed and security

HTTP/3 and QUIC: A new era of speed and security?

Microsoft reports open redirection phishing tactic

Microsoft reports open redirection phishing tactics

Microsoft Exchange Bugs

Microsoft Exchange Proxy Vulnerabilities

PetitPotam: Windows AD CS NTLM Relay Attack

PetitPotam: Windows AD CS NTLM Relay Attack

What is penetration testing and why is it important to use a CREST-approved provider?

What is penetration testing and why is it importa...

What to do after your penetration testing report

What should you do after your penetration testin...

How to prepare your business for secure cloud migration

How to prepare your business for secure cloud mig...

How secure use of the cloud can transform your business

How secure use of the cloud can digitally transfo...

What is crest and how does it benefit you?

What is CREST and what are the benefits of using ...

How can the 10 steps to cyber security help to protect your organisation?

How can the 10 steps to cyber security help to pr...

The importance of cyber security

Celebrating Sentrium’s contribution to cyber secu...

What is OWASP Application Security

What is OWASP application security?

Pentration testing report

What should you do after your penetration testing...

Protect against a phishing attack

How to protect against a phishing attack

Secure data in cloud computing

How to secure data in cloud computing

The Security risks of cloud computing

What are the security risks of cloud computing?

Maintain security when employees work remotely

How to maintain security when employees work remo...

Identify and avoid phishing attacks

How to identify and avoid phishing attacks

Penetration testing

What is penetration testing and why is it important?
  • Left Arrow Icon
  • Right Arrow Icon