Set of mysql queries in a database management software. Querying

Fortinet WAF allows remote code execution

Tim Reed

Tim Reed

A new exploit discovered in Fortinet’s Web application firewall (WAF) solution, FortiWeb, is currently vulnerable to command injection. The vulnerability, affecting versions 6.3.11 and prior, was discovered and reported by a Rapid7 researcher, William Wu. This type of attack has a CVSSv3 base score of 8.7.

The vulnerability requires authentication, but once authenticated, attackers can issue arbitrary commands on the system through the SAML interface as the root user. Wu noted in his writeup that whilst authentication is necessary, this vulnerability could be chained with another method of bypassing authentication (such as CVE-2020-29015), in which the FortiWeb Web Application Firewall is vulnerable to blind SQL injection.

According to the writeup, the research into this exploit would allow an attacker to “take complete control of the affected device, with the highest possible privileges”. Wu has published a Proof of Concept (PoC) code showing the use of HTTP request smuggling, using backticks to smuggle the commands.

Unfortunately, the disclosure of this research seems to have occurred before Fortinet anticipated. Fortinet noted they had expected Rapid7 to hold any of their findings to the end of their 90-day responsible disclosure window.

However, Rapid7 operates a 60-day disclosure policy and chose to disclose this vulnerability after 60 days had passed. Fortinet has indicated that their latest update, FortiWeb 6.4.1, is expected to be released at the end of August and include a fix. The PoC code exists and no patch is available in the meantime. This provides limited options for defenders to protect Fortinet devices in the meantime.

In the interim, users should remove the FortiWeb device management interface from untrusted networks. Generally, any management interface will provide access to sensitive information and administrative functionality, and should not be exposed to reduce the likelihood of compromise. Access should only be possible via trusted, internal networks or over secure VPN.

Sentrium can assist with your security needs, view our penetration testing services for more details or contact us today.

Exploring cyber security

  1. Preparing your business for a penetration test

    May 2, 2025

    Preparing your business for a penetration test

    Read more arrow_right_alt

  2. Maximising the effectiveness of network penetration testing

    March 12, 2025

    Maximising network penetration testing’s effectiveness

    Read more arrow_right_alt

  3. Introducing the new CREST Penetration Testing Accreditation Standard
  4. Automated vs manual penetration testing

    October 15, 2024

    Automated vs manual penetration testing – which is best?

    Read more arrow_right_alt

  5. Mobile application penetration testing

    October 3, 2024

    Safeguard your business with mobile app penetration testing

    Read more arrow_right_alt

  6. White box penetration testing

Ready to discover your security gaps?

Get in touch