PT-2021-3438 · Fortinet · Fortiweb

Andrey Medov · Published 2021-01-04 · Updated 2023-08-25 · CVE-2020-29015

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.3.0 through 6.3.7 FortiWeb versions prior to 6.2.4 FortiWeb versions 6.3.11 and earlier

Description A blind SQL injection in the user interface of FortiWeb may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement. The vulnerability is related to the lack of protection of the SQL query structure. Rapid7 revealed that this vulnerability grants complete control over the affected device.

Recommendations For FortiWeb versions 6.3.0 through 6.3.7, consider disabling the Authorization header until a patch is available. For FortiWeb versions prior to 6.2.4, restrict access to the user interface to minimize the risk of exploitation. For FortiWeb versions 6.3.11 and earlier, avoid using the Authorization header in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2021-03290

CVE-2020-29015

Affected Products

Fortiweb

References · 8

• https://fortiguard.com/psirt/FG-IR-20-124 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29015 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03290 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-29015 · Security Note
• https://t.me/cibsecurity/22163 · Telegram Post
• https://t.me/cvenotify/8542 · Telegram Post
• https://twitter.com/emrahsaridag1/status/1695203842793583041 · Twitter Post
• https://t.me/ptswarm/43 · Telegram Post