Fortinet FortiOS up to 7.0.13/7.2.7/7.4.3 SAML Authentication Link session fixiation

Summaryinfo

A vulnerability, which was classified as critical, has been found in Fortinet FortiOS up to 7.0.13/7.2.7/7.4.3. Impacted is an unknown function of the component SAML Authentication Link Handler. The manipulation leads to session fixiation. This vulnerability is documented as CVE-2023-50176. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Fortinet FortiOS up to 7.0.13/7.2.7/7.4.3. It has been rated as critical. This issue affects an unknown functionality of the component SAML Authentication Link Handler. The manipulation with an unknown input leads to a session fixiation vulnerability. Using CWE to declare the problem leads to CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link.

The advisory is shared at fortiguard.fortinet.com. The identification of this vulnerability is CVE-2023-50176 since 12/05/2023. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 210874 (Fortinet Fortigate - SSLVPN session hijacking using SAML authentication (FG-IR-23-475)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210874). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Fortinet

Name

• FortiOS

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12
• 7.0.13
• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.4.0
• 7.4.1
• 7.4.2
• 7.4.3

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion