Fortinet FortiTester up to 7.2.3 Restore/Backup os command injection

Summaryinfo

A vulnerability was found in Fortinet FortiTester. It has been declared as critical. This affects an unknown part of the component Restore/Backup. Executing a manipulation can lead to os command injection. This vulnerability is handled as CVE-2023-40716. It is possible to launch the attack on the local host. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Fortinet FortiTester. It has been declared as critical. This vulnerability affects some unknown processing of the component Restore/Backup. The manipulation with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An improper neutralization of special elements used in an OS command vulnerability [CWE-78]  in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup .

The weakness was released 12/13/2023 as FG-IR-22-345. The advisory is shared for download at fortiguard.com. This vulnerability was named CVE-2023-40716 since 08/21/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Fortinet

Name

• FortiTester

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.3.0
• 2.4
• 2.4.0
• 2.4.1
• 2.5
• 2.5.0
• 2.6
• 2.6.0
• 2.7
• 2.7.0
• 2.8
• 2.8.0
• 2.9.0
• 3.0
• 3.1
• 3.1.0
• 3.2
• 3.2.0
• 3.3
• 3.3.0
• 3.3.1
• 3.4
• 3.4.0
• 3.5
• 3.5.0
• 3.5.1
• 3.6
• 3.6.0
• 3.7
• 3.7.0
• 3.7.1
• 3.8.0
• 3.9.0
• 3.9.1
• 3.9.2
• 4.0
• 4.1.0
• 4.1.1
• 4.2.0
• 4.2.1
• 7.0
• 7.1.0
• 7.1.1
• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion