Fortinet Patches Critical Bug in FortiClient EMS
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-36554 | A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2 a A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2 all versions allows attacker to execute unauthorized code or commands via specially crafted HTTP requests. NVD description · AI analysis pending | 9.8 | <1% |
| — | ||
| CVE-2023-42789 +1 in the same advisory: …42790 | A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6. A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiProxy 7.2.0 through 7.2.6, FortiProxy 7.0.0 through 7.0.12, FortiProxy 2.0.0 through 2.0.13, FortiSASE 23.2.b allows attacker to execute unauthorized code or commands via specially crafted HTTP requests. NVD description · AI analysis pending | 9.8 group max | 3% |
| — | ||
| CVE-2023-47534 | A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6 A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via specially crafted packets. NVD description · AI analysis pending | 8.8 | 1% |
| — | ||
| CVE-2023-48788 | Unauthenticated SQL Injection in Fortinet FortiClient EMS Fortinet FortiClient EMS — the central management server for FortiClient endpoint deployments — contains a SQL injection flaw (CWE-89) in versions 7.0.1 through 7.0.10 and 7.2.0 through 7.2.2. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) shows it can be triggered remotely with no credentials and no user interaction: an unauthenticated attacker sends specially crafted packets to the vulnerable management server and can execute unauthorized code or commands. Successful exploitation effectively yields remote code execution on the EMS server and access to its database, enabling follow-on actions such as credential theft, abuse of endpoint management functions, and ransomware deployment. Any organization running the affected EMS versions is exposed, especially where the management server is reachable from the internet. Exploitation is confirmed in the wild: CISA added the bug to the KEV catalog on 2024-03-25 with known ransomware use, and EPSS assigns a ~98.4% probability of exploitation within 30 days (100th percentile). Do: Upgrade FortiClient EMS to the fixed releases per Fortinet's advisory for this CVE (7.2.3 and 7.0.11 or later, i.e., beyond the 7.2.2 and 7.0.10 affected ranges); the CISA KEV required action is to apply vendor mitigations or discontinue use if mitigations are unavailable. Until patched, limit exposure of the EMS web interface to untrusted networks and hunt for signs of compromise — anomalous requests to the management console, unexpected database or admin activity, and follow-on ransomware behavior — since exploitation with known ransomware use is confirmed. | 9.8 | 98% | KEV ransomware |
| largetens of thousands of EMS deployments worldwide, with a smaller subset (likely thousands) internet-exposed |
Full article417 words · extracted from infosecurity-magazine.com · click to collapse
Written by
Fortinet has patched a critical SQL injection vulnerability in its endpoint management software which could enable remote code execution (RCE) on targeted servers.
CVE-2023-48788 affects FortiClientEMS 7.2 – versions 7.2.0 to 7.2.2 – and FortiClientEMS 7.0 – versions 7.0.1 to 7.0.10. Discovered by Fortinet and the UK’s National Cyber Security Centre (NCSC), it affects the DB2 Administration Server (DAS) component of the product.
“An improper neutralization of special elements used in an SQL Command (‘SQL Injection’) vulnerability [CWE-89] in FortiClientEMS may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted requests,” the advisory noted.
There’s no information on whether it has been exploited in the wild yet, but that could be a realistic possibility given that security vendor Horizon3 has promised to release indicators of compromise (IoCs), a proof-of-concept exploit and a “deep dive” blog next week.
“In the meantime, check DAS service logs for malicious looking queries,” it warned in a brief post on X (formerly Twitter).
— Horizon3 Attack Team (@Horizon3Attack) March 13, 2024The recent #Fortinet #FortiClient Endpoint Management Server (EMS) SQL injection vulnerability, CVE-2023-48788, allows an unauth attacker to obtain RCE as SYSTEM on the server.
IOCs, POC, and deep-dive blog to be released next week. In the meantime, check DAS service logs for… pic.twitter.com/57ps2WiY8R
It’s been a busy week for Fortinet customers, with the vendor also patching several other vulnerabilities.
These include and out-of-bounds write vulnerability (CVE-2023-42789) and a stack-based buffer overflow (CVE-2023-42790) in the FortiOS and FortiProxy captive portal which could “allow an inside attacker who has access to captive portal to execute arbitrary code or commands via specially crafted HTTP requests.”
Both of these are rated critical, with a CVSS score of 9.3.
The network security vendor also released updates to fix a high-severity CSV injection bug (CVE-2023-47534) in FortiClientEMS.
“An improper neutralization of formula elements in a CSV File vulnerability [CWE-1236] in FortiClientEMS may allow a remote and unauthenticated attacker to execute arbitrary commands on the admin workstation via creating malicious log entries with crafted requests to the server,” Fortinet explained.
Finally, Fortinet patched another high-severity vulnerability (CVE-2023-36554), this time in its FortiWLM MEA for FortiManager product. The improper access control bug could allow an unauthenticated remote attacker to execute arbitrary code or commands via specifically crafted requests.
“Note that FortiWLM MEA is not installed by default on FortiManager and can be disabled as a workaround,” Fortinet said.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/fortinet-patches-critical-bug/