• Kevin McDaniel

Security Bulletin | Multiple Vulnerabilities in Fortinet FortiWeb Could Allow for Arbitrary Code Exe

Vulnerability: Multiple Vulnerabilities in Fortinet FortiWeb Could Allow for Arbitrary Code Execution


This issue affects FortiWeb:


SYSTEMS AFFECTED:


  • FortiWeb versions 6.3.7 and below

  • FortiWeb versions 6.2.3 and below


Technical Summary


Multiple vulnerabilities have been discovered in Fortinet FortiWeb, the most severe of which could allow for arbitrary code execution within the context of a privileged process. Details of these vulnerabilities are as follows:


  • A blind SQL injection in the user interface of FortiWeb may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement. (CVE-2020-29015)

  • A stack-based buffer overflow vulnerability in FortiWeb may allow an unauthenticated, remote attacker to overwrite the content of the stack and potentially execute arbitrary code by sending a crafted request with a large certname. (CVE-2020-29016)

  • A format string vulnerability in FortiWeb may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter. (CVE-2020-29018)

  • A stack-based buffer overflow vulnerability in FortiWeb may allow a remote, authenticated attacker to crash the httpd daemon thread by sending a request with a crafted cookie header. (CVE-2020-29019)


Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution within the context of the affected application. Depending on the privileges associated with this application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.



RISK


Government:


  • Large and medium government entities: HIGH

  • Small government entities: HIGH


Businesses:


  • Large and medium business entities: HIGH

  • Small business entities: HIGH


Home Users: N/A



RECOMMENDATIONS


We recommend the following actions be taken:


  • Apply appropriate updates by Fortinet to vulnerable systems, immediately after appropriate testing.

  • Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.

  • Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.



REFERENCES


FortiGuard:


https://www.fortiguard.com/psirt/FG-IR-20-123


https://www.fortiguard.com/psirt/%20FG-IR-20-124


https://www.fortiguard.com/psirt/FG-IR-20-125


https://www.fortiguard.com/psirt/%20FG-IR-20-126



CVE:


https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29015


https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29016


https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29018


https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29019

3 views0 comments

Recent Posts

See All

Contact Us

 Address. 3030 Laura Lane, Suite 213, Middleton, WI  53562

Tel. (608) 467-4431

© 2023 by ITSG. 

  • Facebook Social Icon
  • Twitter Social Icon
  • LinkedIn Social Icon
IT Strategies Group's logo representing our focus on IT Backup, Recovery, Infrastructure, Architectue, Managed Services and AWESOME service.