#FortiGate_Vulnerability-May-2023(FortiOS & FortiProxy – Out-of-bound-write in sslvpnd)
Report by: Hazem Mohamed
More information about CWE-787:
https://www.cvedetails.com/cwe-details/787/Out-of-bounds-Write.html
More Information about CVE-2023-22640:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22640
Summary
An out-of-bounds write vulnerability [CWE-787] in sslvpnd of FortiOS and FortiProxy may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted requests.
Affected Products
FortiOS version 7.2.0 through 7.2.3
FortiOS version 7.0.0 through 7.0.10
FortiOS version 6.4.0 through 6.4.11
FortiOS version 6.2.0 through 6.2.13
FortiOS 6.0 all versions
FortiProxy version 7.2.0 through 7.2.1
FortiProxy version 7.0.0 through 7.0.7
FortiProxy all versions 2.0, 1.2, 1.1, 1.0
Solutions
Please upgrade to FortiOS version 7.4.0 or above
Please upgrade to FortiOS version 7.2.4 or above
Please upgrade to FortiOS version 7.0.11 or above
Please upgrade to FortiOS version 6.4.12 or above
Please upgrade to FortiOS version 6.2.14 or above
Please upgrade to FortiProxy version 7.2.2 or above
Please upgrade to FortiProxy version 7.0.8 or above
Workaround if you can’t upgrade:
Disable "Host Check", "Restrict to Specific OS Versions" and "MAC address host checking" in sslvpn portal configuration. For example for "full-access” sslvpn portal:
config vpn ssl web portal
edit "full-access"
set os-check disable
set host-check none
set mac-addr-check disable
end
References :
https://www.cybersecurity-help.cz/vdb/SB2020121102
https://www.fortiguard.com/psirt-monthly-advisory/may-2023-vulnerability-advisories
https://vuldb.com/?id.227952
BR,
Hazem Mohamed- SC&BC
hmohamed200@gmail.com
