PT-2023-1535 · Fortinet · Fortiweb

CVE-2023-23777 · Publicado 2023-02-16 · Atualizado 2023-07-18

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiWeb versions 7.0.1 and below FortiWeb version 6.4 all versions FortiWeb version 6.3.18 and below

Description The issue is related to an improper neutralization of special elements used in an OS command, which may allow a privileged attacker to execute arbitrary bash commands via crafted cli backup parameters. Exploitation of this issue can enable a remote attacker to execute arbitrary code or commands using a specially crafted HTTP request.

Recommendations For FortiWeb versions 7.0.1 and below, update to a version above 7.0.1 to resolve the issue. For FortiWeb version 6.4 all versions, consider disabling the cli backup feature until a patch is available. For FortiWeb version 6.3.18 and below, restrict access to the backup parameters to minimize the risk of exploitation.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2023-00979

CVE-2023-23777

Produtos afetados

Fortiweb

Referências · 4

• https://bdu.fstec.ru/vul/2023-00979 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-23777 · Nota de Segurança
• https://fortiguard.com/psirt/FG-IR-22-131 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-23777 · Aviso do Fabricante