Fortinet fixed a critical flaw in FortiOS and FortiProxy

Fortinet warns of a critical vulnerability impacting FortiOS and FortiProxy that can allow remote attackers to perform arbitrary code execution.

Fortinet has disclosed a critical vulnerability, tracked as CVE-2023-33308 (CVSS score 9.8), that impacts FortiOS and FortiProxy. A remote attacker can exploit the vulnerability to perform arbitrary code execution on vulnerable devices.

The issue is a stack-based overflow vulnerability that can be exploited via crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection.

“A stack-based overflow vulnerability [CWE-124] in FortiOS & FortiProxy may allow a remote attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection.” reads the advisory published by the vendor.

The vulnerability impacts the following FortiOS versions: 

• FortiOS version 7.2.0 through 7.2.3
• FortiOS version 7.0.0 through 7.0.10
• FortiProxy version 7.2.0 through 7.2.2
• FortiProxy version 7.0.0 through 7.0.9

The following versions address the vulnerability:

• FortiOS version 7.2.4 or above
• FortiOS version 7.0.11 or above
• FortiProxy version 7.2.3 or above
• FortiProxy version 7.0.10 or above

The vulnerability was discovered by researchers at the security firm Watchtowr.

The advisory also provides a workaround to address the vulnerability recommending disabling HTTP/2 support on SSL inspection profiles used by proxy policies or firewall policies with proxy mode.

US CISA published an alert to urge organizations to update their installs.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, FortiOS)