Fortinet 18 December 2024 security advisory FG-IR-23-144 (error loading post)

[screaminggoat@infosec.exchange]

Fortinet 18 December 2024 security advisory FG-IR-23-144 (error loading post)
CVE-2023-34990 (9.8 critical) relative path traversal in Fortinet FortiWLM leads to code and command execution: released today, 557 days after it was reserved by Fortinet on 09 June 2023. Unable to view the advisory in order to determine exploitation. Shame on them for waiting a year to patch/announce the vulnerability.

h/t: @cR0w

#fortinet #fortwlm #vulnerability #CVE #infosec #cybersecurity

[screaminggoat@infosec.exchange]

CVE-2023-34990 is credited to @hacks_zach of Horizon3.ai. This gave me a starting point for figuring out where to look for information. It's contained in Fortinet FortiWLM Deep-Dive, IOCs, and the Almost Story of the “Forti Forty” posted on 14 March 2024.

It is described as an unpatched vulnerability: "Unauthenticated Limited Log File Read – Allows retrieval of arbitrary log files which contain administrator session ID tokens" Check out the Path to Remote Code Execution #2 section for vulnerability details:

This vulnerability allows remote, unauthenticated attackers to access and abuse builtin functionality meant to read specific log files on the system via a crafted request to the /ems/cgi-bin/ezrf_lighttpd.cgi endpoint. This issue results from the lack of input validation on request parameters allowing an attacker to traverse directories and read any log file on the system.

Based on the details of the blog, I can confidently say that the new CVE and the blog's vulnerability are almost certainly one and the same.

cc: @GossiTheDog @jerry

#CVE_2023_34990 #fortinet #fortiwlm #vulnerability #CVE #infosec #cybersecurity

[ryanc@infosec.exchange]

@screaminggoat @hacks_zach @GossiTheDog @jerry this is a level of rich content that i was not prepared for

[jerry@infosec.exchange]

@ryanc @screaminggoat @hacks_zach @GossiTheDog a recent mastodon/glitch-soc update did change that

[rallias@hax.social]

@jerry @ryanc @screaminggoat @hacks_zach @GossiTheDog hasn't glitch-soc supported markdown since at least 4.0?

[jerry@infosec.exchange]

@rallias @ryanc @screaminggoat @hacks_zach @GossiTheDog yeah, but the way it’s displayed has been updated

[ryanc@infosec.exchange]

@jerry @rallias @screaminggoat @hacks_zach @GossiTheDog it's all fancy pants now