Flash Notice: Three Critical Fortinet Vulnerabilities Found in Several Products

overview

Three critical vulnerabilities have been found in several Fortinet products this week:  

CVE-2023-48788 (CVSS 9.8) - SQL Injection in FortiClientEMS 

• Attackers can exploit this flaw to execute malicious code or commands via specially crafted HTTP requests. 
• This vulnerability affects FortiClientEMS versions 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10. 

CVE-2023-42789 (CVSS 9.8) - Out-of-Bounds Write in FortiOS and FortiProxy: 

• This vulnerability allows attackers to execute unauthorized code or commands by exploiting FortiProxy via specially crafted HTTP requests. 
• The vulnerability affects FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13. 

CVE-2023-42790 (CVSS 8.1) - Stack-Based Buffer Overflow in FortiOS and FortiProxy: 

• Similar to CVE-2023-42789, this flaw allows attackers to execute unauthorized code or commands through specially crafted HTTP requests directed at FortiOS. 
• This vulnerability affects 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13 

There is no evidence of attackers exploiting these vulnerabilities in the wild, and Fortinet has provided updates for the flaws. However, successful exploitation could allow threat actors to take over vulnerable systems. 

avertium's recommendationS

• Fortinet recommends upgrading to the following versions:  
  • FortiClientEMS 7.20 through 7.2.2 – upgrade to 7.2.3 or above  
  • FortiClientEMS 7.0.10 – upgrade to 7.0.11 or above. 
  • See Fortinet’s advisory for more details.  

• Fortinet recommends upgrading to the following:  
  • FortiOS version 7.4.2 or above 
  • FortiOS version 7.2.6 or above 
  • FortiOS version 7.0.13 or above 
  • FortiOS version 6.4.15 or above 
  • FortiOS version 6.2.16 or above 
  • FortiProxy version 7.4.1 or above 
  • FortiProxy version 7.2.7 or above 
  • FortiProxy version 7.0.13 or above 
  • FortiProxy version 2.0.14 or above 
  • Fortinet’s advisory states that in Q3/23 has remediated this issue in FortiSASE version 23.3.b, therefore customers do not need to perform any action. 
  • See Fortinet’s advisory for more details.  

INDICATORS OF COMPROMISE (IoCs)

At this time, there are no known IoCs associated with the above vulnerabilities. Avertium remains vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.   

How Avertium is Protecting Our CUSTOMERS

• Expanding endpoints, cloud computing environments, and accelerated digital transformation have decimated the perimeter in an ever-expanding attack surface. Avertium offers Attack Surface Management, so you’ll have no more blind spots, weak links, or fire drills. See every threat in your attack surface, every device, every entry point, and every vulnerability. Our Attack Surface Management services include:  
  • Risk Assessments 
  • Pen Testing and Social Engineering  
  • Infrastructure Architecture and Integration  
  • Zero Trust Network Architecture 
  • Vulnerability Management 

• We highly value your feedback. Kindly spare a moment to complete our feedback form, allowing us to enhance our services for our valued customers. 

SUPPORTING DOCUMENTATION