A Vulnerability in Fortinet FortiWeb Could Allow for Arbitrary Code Execution

DESCRIPTION:
A vulnerability has been discovered in Fortinet FortiWeb that could
allow for arbitrary code execution. Fortinet FortiWeb is a firewall for
web applications, which provides threat protection for medium and large
enterprises. Successful exploitation of this vulnerability could allow
for arbitrary code execution within the context of the affected
application. Depending on the privileges associated with this
application, an attacker could then install programs; view, change, or
delete data; or create new accounts with full user rights. If this
application has been configured to have fewer user rights on the system,
exploitation of this vulnerability could have less impact than if it was
configured with administrative rights.

IMPACT:
A vulnerability has been discovered in Fortinet FortiWeb, that could
allow for arbitrary code execution. This vulnerability can be exploited
when an unauthenticated attacker overwrites the content of the stack by
sending crafted HTTP requests with large request parameter values.

Successful exploitation of this vulnerability could allow for arbitrary
code execution within the context of the affected application. Depending
on the privileges associated with this application, an attacker could
then install programs; view, change, or delete data; or create new
accounts with full user rights. If this application has been configured
to have fewer user rights on the system, exploitation of this
vulnerability could have less impact than if it was configured with
administrative rights.

SYSTEM AFFECTED:
* FortiWeb versions prior to 6.4.1
* FortiWeb versions prior to 6.3.16
* FortiWeb versions prior to 6.2.6

RECOMMENDATIONS:
We recommend the following actions be taken:

* Apply appropriate updates by Fortinet to vulnerable systems,
immediately after appropriate testing.
* Remind users not to visit un-trusted websites or follow links provided
by unknown or un-trusted sources.
* Inform and educate users regarding threats posed by hypertext links
contained in emails or attachments, especially from un-trusted sources.

REFERENCES:
https://www.fortiguard.com/psirt/FG-IR-21-119
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36186

Published: 22 December 2021, 11:59:09 BST