Rewterz Threat Advisory – Multiple Fortinet Products Vulnerabilities

Severity

High

Analysis Summary

CVE-2022-40682 CVSS:7.8

FortiClient (Windows) could allow a local authenticated attacker to execute arbitrary code on the system, caused by incorrect authorization. An attacker could exploit this vulnerability to create arbitrary files in the device filesystem and execute arbitrary code or commands on the system.

CVE-2022-40679 CVSS:7.8

Fortinet FortiADC, Fortinet FortiDDoS, and Fortinet FortiDDoS-F could allow a local authenticated attacker to execute arbitrary commands on the system, caused by an OS command injection vulnerability. By sending specially-crafted arguments, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

CVE-2022-43951 CVSS:5.3

Fortinet FortiNAC could allow a remote attacker to obtain sensitive information. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.

CVE-2023-27995 CVSS:7.2

Fortinet FortiSOAR could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper neutralization of special elements used in a template engine. By using a specially-crafted payload, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2023-22635 CVSS:7.3

Fortinet FortiClient (Mac) could allow a local authenticated attacker to gain elevated privileges on the system, caused by download of code without integrity checks. By modifying the installer upon upgrade, an attacker could exploit this vulnerability to gain elevated privileges.

CVE-2022-42477 CVSS:7.1

Fortinet FortiAnalyzer could allow a local authenticated attacker to obtain sensitive information, caused by improper validation of user-supplied input. By sending custom dataset SQL queries, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.

CVE-2023-22641 CVSS:4.1

Fortinet FortiOS and FortiProxy could allow a remote authenticated attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit this vulnerability using a specially-crafted URL to redirect a victim to arbitrary Web sites.

CVE-2022-43948 CVSS:6.7

Fortinet FortiWeb and FortiADC could allow a local authenticated attacker to execute arbitrary commands on the system, caused by improper neutralization of user-supplied input by the command line interpreter. An attacker could exploit this vulnerability to execute arbitrary commands on the system.

CVE-2022-41331 CVSS:9.8

Fortinet FortiPresence could allow a remote attacker to bypass security restrictions, caused by missing authentication. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authentication and obtain access to the Redis and MongoDB instances.

Impact

• Code Execution
• Command Execution
• Information Disclosure
• Privilege Escalation
• Gain Access
• Security Bypass

Indicators Of Compromise

CVE

• CVE-2022-40682
• CVE-2022-40679
• CVE-2022-43951
• CVE-2023-27995
• CVE-2023-22635
• CVE-2022-42477
• CVE-2023-22641
• CVE-2022-43948
• CVE-2022-41331

Affected Vendors

Fortinet

Affected Products

• FortiNet FortiClient for Windows 6.0.5
• Fortinet FortiClient for Windows 6.0.4
• FortiNet FortiClient for Windows 6.2.0
• Fortinet FortiClient for Windows 6.2.1
• Fortinet FortiClient for Windows 6.2.3
• Fortinet FortiADC 5.0Fortinet FortiADC 5.1
• Fortinet FortiADC 5.2Fortinet FortiADC 5.3
• Fortinet FortiSOAR 7.3.0
• Fortinet FortiSOAR 7.3.1
• Fortinet FortiClient 6.2.1 Mac OS
• Fortinet FortiClient 6.4.0 for macOS
• Fortinet FortiAnalyzer 6.4Fortinet FortiAnalyzer 7.0.6
• Fortinet FortiAnalyzer 7.2.1
• Fortinet FortiOS 6.0
• Fortinet FortiOS 6.2
• Fortinet FortiOS 6.4.0
• Fortinet FortiOS 6.4.11
• Fortinet FortiADC 5.4

Remediation

Refer to FortiGuard Advisory for patch, upgrade or suggested workaround information.

CVE-2022-40682

CVE-2022-40679

CVE-2022-43951

CVE-2023-27995

CVE-2023-22635

CVE-2022-42477

CVE-2023-22641

CVE-2022-43948

CVE-2022-41331