Fortinet notifies users of a critical OS command injection vulnerability in the FortiSIEM report server that might enable an unauthenticated, remote attacker to execute malicious commands via crafted API requests.
FortiSIEM is Fortinet’s security information and event management (SIEM) solution, which assists in identifying insider and incoming threats that could pass standard defenses.
“An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiSIEM report server may allow a remote unauthenticated attacker to execute unauthorized commands via crafted API requests”, reads the advisory published by Fortinet.
Specifics of the Critical OS Command Injection Vulnerability
The OS command injection vulnerability in FortiSIEM, with a CVSS Score of 9.3, is tracked as CVE-2023-36553.
The execution of arbitrary commands on a host operating system (OS) is called command injection. Typically, the threat actor injects the commands by taking advantage of an application flaw, such as insufficient input validation.
The command injection vulnerability can result from unauthorized access, data breaches, and even system compromise.
Additionally, it was discovered that this critical FortiSIEM injection vulnerability (CVE-2023-36553) is a variant of CVE-2023-34992, another critical vulnerability previously fixed in October of this year.
In Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.5, 6.6.0 through 6.6.3, 6.5.0 through 6.5.1, and 6.4.0 through 6.4.2, improper neutralization of special elements used in an OS command (also known as “os command injection“) tracked as CVE-2023-34992 allows an attacker to execute unauthorized code or commands via crafted API requests.
Improper input sanitization allows OS command execution, which increases the risk of unauthorized data access, modification through API requests, and deletion through API requests.
Affected Products:
- FortiSIEM 5.4 all versions
- FortiSIEM 5.3 all versions
- FortiSIEM 5.2 all versions
- FortiSIEM 5.1 all versions
- FortiSIEM 5.0 all versions
- FortiSIEM 4.10 all versions
- FortiSIEM 4.9 all versions
- FortiSIEM 4.7 all versions
Solutions:
- FortiSIEM version 7.1.0 or above
- FortiSIEM version 7.0.1 or above
- FortiSIEM version 6.7.6 or above
- FortiSIEM version 6.6.4 or above
- FortiSIEM version 6.5.2 or above
- FortiSIEM version 6.4.3 or above
It is unclear whether the vulnerability is actively exploited in attacks in the wild. The users of Fortinet are advised to upgrade to the latest version released.
Patch Manager Plus, the one-stop solution for automated updates of over 850 third-party applications: Try Free Trial.