Fortinet FortiClientWindows up to 6.4.10/7.0.12/7.2.4 LUA Auto Patch Script privilege context switching

Summaryinfo

A vulnerability classified as critical was found in Fortinet FortiClientWindows up to 6.4.10/7.0.12/7.2.4. Affected is an unknown function of the component LUA Auto Patch Script Handler. Such manipulation leads to privilege context switching. This vulnerability is listed as CVE-2024-36513. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Fortinet FortiClientWindows up to 6.4.10/7.0.12/7.2.4. It has been rated as critical. Affected by this issue is an unknown function of the component LUA Auto Patch Script Handler. The manipulation with an unknown input leads to a privilege context switching vulnerability. Using CWE to declare the problem leads to CWE-270. The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A privilege context switching error vulnerability [CWE-270] in FortiClient Windows version 7.2.4 and below, version 7.0.12 and below, 6.4 all versions may allow an authenticated user to escalate their privileges via lua auto patch scripts.

The advisory is shared for download at fortiguard.fortinet.com. This vulnerability is handled as CVE-2024-36513 since 05/29/2024. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability scanner Nessus provides a plugin with the ID 210876 (Fortinet FortiClient Privilege escalation via lua auto patch function (FG-IR-24-144)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210876). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Fortinet

Name

• FortiClientWindows

Version

• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.4.5
• 6.4.6
• 6.4.7
• 6.4.8
• 6.4.9
• 6.4.10
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12
• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion