Fortinet FortiOS 4.3.8 /firewall/policy/policy6 Applied Tags/Tags Display cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in Fortinet FortiOS 4.3.8. This impacts an unknown function of the file /firewall/policy/policy6. Such manipulation of the argument Applied Tags/Tags Display leads to cross site scripting. It is possible to launch the attack remotely. Furthermore, an exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Fortinet FortiOS 4.3.8 (Firewall Software) and classified as problematic. Affected by this issue is an unknown code block of the file /firewall/policy/policy6. The manipulation of the argument Applied Tags/Tags Display with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. Impacted is confidentiality, integrity, and availability. The FortiGate series of multi-threat security systems detect and eliminate the most damaging, content-based threats from email and Web traffic such as viruses, worms, intrusions, inappropriate Web content and more in real time.

The weakness was published 09/06/2012 by Benjamin Kunz Mejri with Vulnerability-Lab Research Team as 557 as confirmed advisory (Website). The advisory is shared for download at vulnerability-lab.com. The public release has been coordinated with the vendor. The exploitation is known to be easy. The attack may be launched remotely. The requirement for exploitation is a simple authentication. Successful exploitation requires user interaction by the victim. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1059.007.

A public exploit has been developed by Benjamin Kunz Mejri in HTML/Javascript and been published immediately after the advisory. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 107 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 4.3.8 B0537 or 5.0 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (21395) and OSVDB (86082†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Fortinet

Name

• FortiOS

Version

• 4.3.8

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion