25th August 2021
2 min read
A new exploit discovered in Fortinet’s Web application firewall (WAF) solution, FortiWeb, is currently vulnerable to command injection. The vulnerability, affecting versions 6.3.11 and prior, was discovered and reported by a Rapid7 researcher, William Wu. This type of attack has a CVSSv3 base score of 8.7.
The vulnerability requires authentication, but once authenticated, attackers can issue arbitrary commands on the system through the SAML interface as the root user. Wu noted in his writeup that whilst authentication is necessary, this vulnerability could be chained with another method of bypassing authentication (such as CVE-2020-29015), in which the FortiWeb Web Application Firewall is vulnerable to blind SQL injection.
According to the writeup, the research into this exploit would allow an attacker to “take complete control of the affected device, with the highest possible privileges”. Wu has published a Proof of Concept (PoC) code showing the use of HTTP request smuggling, using backticks to smuggle the commands.
Unfortunately, the disclosure of this research seems to have occurred before Fortinet anticipated. Fortinet noted they had expected Rapid7 to hold any of their findings to the end of their 90-day responsible disclosure window.
However, Rapid7 operates a 60-day disclosure policy and chose to disclose this vulnerability after 60 days had passed. Fortinet has indicated that their latest update, FortiWeb 6.4.1, is expected to be released at the end of August and include a fix. The PoC code exists and no patch is available in the meantime. This provides limited options for defenders to protect Fortinet devices in the meantime.
In the interim, users should remove the FortiWeb device management interface from untrusted networks. Generally, any management interface will provide access to sensitive information and administrative functionality, and should not be exposed to reduce the likelihood of compromise. Access should only be possible via trusted, internal networks or over secure VPN.
Sentrium can assist with your security needs, view our penetration testing services for more details or contact us today.
Resources
- Insights
- Labs
Sentrium Achieves ISO 9001 and ISO 27001 Certifications
In an increasingly digital world, the importance of quality and security cannot be overstated. Sentrium Security Ltd is excited to share our recent achievement –…
What are the different types of penetration testing?
As digital business becomes more widespread, the need to ensure data security increases. One way to test its effectiveness is through penetration testing. Penetration tests…
The Open Web Application Security Project (OWASP) is a not-for-profit organisation that aims, through community-led open-source projects, to improve the security of web-based software. OWASP…
What is CREST penetration testing and why is it important to use a CREST-approved provider?
Trusting the effectiveness of your IT security controls is crucial to mitigate risks and malicious access to your systems and the information they store. Penetration…
How secure use of the cloud can digitally transform your business
Companies that move towards digital transformation can innovate more quickly, scale efficiently and reduce risk by implementing cloud security best practices. Businesses must keep up…
How to prepare your business for secure cloud migration
The cloud holds a lot of potential for organisations. Moving your IT environment to a secure cloud provides flexibility and agility. It allows your team…
Application Security 101 – HTTP Headers Information Disclosure
Server Header Information Disclosure The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead…
SPF, DKIM, DMARC and BIMI for Email Security
Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…
Terraform security best practices (2022)
The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…
Preventing exploitation of the Follina vulnerability in MSDT
The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…
Application Security 101 – HTTP headers
1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…
New Exchange RCE vulnerability actively exploited
Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell.…