Vulnerabilities in Fortinet WAF Can Expose Corporate Networks to Attacks

guest · Jan 9, 2021

Vulnerabilities in Fortinet WAF Can Expose Corporate Networks to Attacks
January 7, 2021
https://www.securityweek.com/vulnerabilities-fortinet-waf-can-expose-corporate-networks-attacks

Fortinet this week informed customers about the availability of patches for a total of four vulnerabilities affecting its FortiWeb product. According to advisories published by the company, the flaws can be exploited for denial-of-service (DoS) attacks and to execute unauthorized code or commands.
The CVE identifiers CVE-2020-29015, CVE-2020-29016, CVE-2020-29019 and CVE-2020-29018 have been assigned.

Three of the flaws, described as a SQL injection issue and two buffer overflows, can be exploited by a remote attacker without authentication. However, Fortinet only assigned them a CVSS score of 6.4 (medium severity) and a risk rating of 3/5.

“We believe the severity is more critical than the score assigned by the vendor,” Medov said.
Click to expand...

guest · Jun 26, 2021

Vulnerabilities Expose Fortinet Firewalls to Remote Attacks
A high-severity vulnerability patched recently by Fortinet in its FortiWeb web application firewall (WAF) can be exploited to execute arbitrary commands
June 25, 2021
https://www.securityweek.com/vulnerabilities-expose-fortinet-firewalls-remote-attacks

Andrey Medov, a researcher at Russian enterprise cybersecurity firm Positive Technologies, discovered that the FortiWeb firewall — specifically its management interface — is affected by a vulnerability that can allow a remote, authenticated attacker to execute commands on the system via the SAML server configuration page.

The flaw, tracked as CVE-2021-22123, has been patched with the release of FortiWeb versions 6.3.8 and 6.2.4, Fortinet said in an advisory published in late May.
Medov warned on Thursday that the vulnerability can be exploited by an authenticated attacker to execute arbitrary commands with maximum privileges, which can be used to take complete control of the server.
Click to expand...

The researcher noted that the impact of the vulnerability can be even more serious if it’s chained with a misconfiguration and a separate vulnerability he discovered recently in FortiWeb.

That vulnerability, tracked as CVE-2020-29015 and disclosed by Fortinet in January, is a medium-severity blind SQL injection issue that can allow a remote, unauthenticated attacker to execute SQL commands or queries by sending a specially crafted request.
Click to expand...

guest · Aug 17, 2021

Fortinet patches bug letting attackers takeover servers remotely
August 17, 2021
https://www.bleepingcomputer.com/ne...-letting-attackers-takeover-servers-remotely/

Fortinet has released security updates to address a command injection vulnerability that can let attackers take complete control of servers running vulnerable FortiWeb web application firewall (WAF) installations.

The security flaw discovered by Rapid7 researcher William Vu impacts is yet to receive a CVE ID, and it impacts Fortinet FortiWeb versions 6.3.11 and earlier.
Successful exploitation allows authenticated attackers to execute arbitrary commands as the root user on the underlying system via the SAML server configuration page.
Click to expand...

To defend against attacks that would try to exploit this bug, admins are advised to block access to the FortiWeb device's management interface from untrusted networks (i.e., the Internet).
Such devices should only be reachable via trusted, internal networks or a secure VPN connection to block threat actors' exploitation attempts.
Click to expand...

Log in or Sign up

Vulnerabilities in Fortinet WAF Can Expose Corporate Networks to Attacks

guest Guest

guest Guest

guest Guest

Log in or Sign up

Vulnerabilities in Fortinet WAF Can Expose Corporate Networks to Attacks

guest Guest

guest Guest

guest Guest

Useful Searches