Fortinet Release Multiple Security Updates

Updates address 1 Low, 8 Medium, and 5 High severity vulnerabilities including an actively exploit vulnerability in FortiOS

Threat ID:: CC-4281
Threat Severity:: Medium
Published:: 10 March 2023 4:32 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Updates address 1 Low, 8 Medium, and 5 High severity vulnerabilities including an actively exploit vulnerability in FortiOS

Affected platforms

The following platforms are known to be affected:

Fortinet FortiOS

Fortinet FortiProxy

FortiNAC

Fortinet FortiManager

The following platforms are also known to be affected:

FortiAnalyzer
FortiAuthenticator
FortiDeceptor
FortiMail
FortiPortal
FortiSwitch
FortiSOAR
FortiRecorder

Threat details

Introduction

Fortinet has released security updates to address 1 Low, 8 Medium, and 5 High severity vulnerabilities in FortiNAC, FortiWeb, FortiOS, and other Fortinet products. The High severity vulnerabilities include CVE-2022-40676 - a cross-site scripting (XSS) vulnerability in FortiNAC, CVE-2022-39953 - an improper privilege management vulnerability in FortiNAC, CVE-2022-25605 - an improper access control vulnerability in FortiSOAR, CVE-2022-42476 - a relative path traversal vulnerability in FortiOS and FortiProxy, and CVE-2022-39951 - an improper neutralisation of special elements in an OS command vulnerability in FortiWeb.

Exploitation in the wild for CVE-2022-41328

CVE-2022-41328 is a path traversal vulnerability affecting FortiOS has been reported to be actively exploited. The vulnerability could allow an authenticated remote attacker to execute arbitrary code or commands.

Threat updates

Date	Update
14 Mar 2023	Exploitation in the wild for CVE-2022-41328 This Cyber alert has been updated to reflect the change in exploitation status of CVE-2022-41328 and has been upgraded to Medium severity.

Remediation advice

Affected organisations are encouraged to review Fortinet's Security Advisory and apply the relevant updates.

Remediation steps

Type	Step
Patch	FortiAnalyzer - CSV injection in macro name \| FG-IR-22-488 https://www.fortiguard.com/psirt/FG-IR-22-488
Patch	FortiAnalyzer -- the log-fetch client request password is shown in clear text in the heartbeat response \| FG-IR-22-447 https://www.fortiguard.com/psirt/FG-IR-22-447
Patch	FortiAuthenticator, FortiDeceptor & FortiMail - Improper restriction over excessive authentication attempts \| FG-IR-20-078 https://www.fortiguard.com/psirt/FG-IR-20-078
Patch	FortiManager, FortiAnalyzer, FortiPortal & FortiSwitch - Information disclosure through diagnose debug commands \| FG-IR-18-232 https://www.fortiguard.com/psirt/FG-IR-18-232
Patch	FortiNAC - Multiple privilege escalation via sudo command \| FG-IR-22-309 https://www.fortiguard.com/psirt/FG-IR-22-309
Patch	FortiOS & FortiProxy - Access of NULL pointer in SSLVPNd \| FG-IR-22-477 https://www.fortiguard.com/psirt/FG-IR-22-477
Patch	FortiOS - Path traversal in execute command \| FG-IR-22-369 https://www.fortiguard.com/psirt/FG-IR-22-369
Patch	FortiOS / FortiProxy - Path traversal vulnerability allows VDOM escaping \| FG-IR-22-401 https://www.fortiguard.com/psirt/FG-IR-22-401
Patch	FortiOS / FortiProxy - Unauthenticated access to static files containing logging information \| FG-IR-22-364 https://www.fortiguard.com/psirt/FG-IR-22-364
Patch	FortiRecorder - DoS in login authentication mechanism \| FG-IR-22-388 https://www.fortiguard.com/psirt/FG-IR-22-388
Patch	FortiSOAR - Improper Authorization in request headers \| FG-IR-23-050 https://www.fortiguard.com/psirt/FG-IR-23-050
Patch	FortiWeb - command injection in webserver \| FG-IR-22-254 https://www.fortiguard.com/psirt/FG-IR-22-254
Patch	FortiWeb and FortiRecorder - Arbitrary file read through command line pipe \| FG-IR-21-218 https://www.fortiguard.com/psirt/FG-IR-21-218

Definitive source of threat updates

https://www.fortiguard.com/psirt

CVE Vulnerabilities

Status Published

CVE-2022-41328

A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.

Status Published

CVE-2023-25611

A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 allows local attacker to execute unauthorized code or commands via inserting spreadsheet formulas in macro names.

Status Published

CVE-2023-23776

An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiAnalyzer versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4 and 6.4.0 through 6.4.10 may allow a remote authenticated attacker to read the client machine password in plain text in a heartbeat response when a log-fetch request is made from the FortiAnalyzer

Status Published

CVE-2022-29056

A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form.

Status Published

CVE-2022-27490

A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.x, 6.0.x allows an attacker which has obtained access to a restricted administrative account to obtain sensitive information via `diagnose debug` commands.

Status Published

CVE-2022-40676

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted http requests.

Status Published

CVE-2022-39953

A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1.0 through 9.1.8, FortiNAC all versions 8.8, FortiNAC all versions 8.7, FortiNAC all versions 8.6, FortiNAC all versions 8.5, FortiNAC version 8.3.7 allows attacker to escalation of privilege via specially crafted commands.

Status Published

CVE-2022-45861

An access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated attacker to crash the sslvpn daemon via an HTTP GET request.

Status Published

CVE-2022-42476

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.

Status Published

CVE-2022-41329

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiOS version 7.2.0 through 7.2.3 and 7.0.0 through 7.0.9 allows an unauthenticated attackers to obtain sensitive logging informations on the device via crafted HTTP GET requests.

Status Published

CVE-2022-41333

An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests.

Status Published

CVE-2023-25605

A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the administrative interface to perform unauthorized actions via crafted HTTP requests.

Status Published

CVE-2022-39951

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Status Published

CVE-2022-22297

An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments.

Last edited: 14 March 2023 12:13 pm