Fortinet RCE Vulnerability

Dataprise Defense Digest

ID: D3-2023-0008-1
CVE Score: 9.8 Critical

Published: July 12, 2023

Executive Summary

Fortinet has disclosed a Remote Code Execution (RCE) vulnerability that can allow an attacker to execute arbitrary code remotely, potentially compromising the affected devices and their associated networks. This vulnerability is being tracked as CVE-2023-33308, and affects Fortinet devices including firewalls, routers, and VPN gateways.

Dataprise is aware of the critical nature of this vulnerability and has completed a review of all available analyses of these vulnerabilities and the potential impact on our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customer-facing service interruptions. If your organization’s Fortinet appliance is covered under a Dataprise Managed Service agreement, we will send a follow-up communication with details on our mitigation efforts.

Detailed Analysis

CVE-2023-33308 is a critical security vulnerability identified in Fortinet devices, including but not limited to firewalls, routers, and VPN gateways. The vulnerability arises due to insufficient input validation within the affected devices’ processing of specific network packets. An attacker can exploit this vulnerability by sending maliciously crafted packets to the targeted device, leading to remote code execution.

The potential impact of this vulnerability is severe. Successful exploitation could allow an attacker to gain unauthorized access to the affected device, compromise its integrity, and potentially pivot further into the network. By executing arbitrary code, the attacker may gain complete control over the device, leading to unauthorized data access, network disruption, or further attacks against connected systems.

Affected Versions

FortiOS               7.2.3, 7.2.2, 7.2.1, 7.2.0, 7.0.10, 7.0.9, 7.0.8, 7.0.7, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0
FortiProxy          7.2.2, 7.2.1, 7.2.0, 7.0.9, 7.0.8, 7.0.7, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0

Patched Versions

FortiOS version 7.4.0 or above

FortiOS version 7.2.4 or above

FortiOS version 7.0.11 or above

FortiProxy version 7.2.3 or above

FortiProxy version 7.0.10 or above

Recommended Resolution

Update Fortinet Devices: Immediately apply the official patch or firmware update provided by Fortinet. This will ensure that the vulnerability is effectively remediated, and the devices are protected against potential exploitation.

Perform a Security Assessment: Conduct a thorough security assessment of the affected Fortinet devices to identify any signs of compromise or unauthorized access. Review logs, monitor network traffic, and perform system scans to ensure the integrity and security of the devices.

Please note that the recommended resolution may evolve based on official guidance and updates from Fortinet. It is crucial to stay informed through the official sources mentioned earlier and to promptly apply any new patches or recommendations provided by the vendor.

Workaround

Disable HTTP/2 Support on SSL Inspection Profiles.

Fortinet’s example with custom-deep-inspection profile:

Sources

• https://www.isgtech.com/remote-code-execution-vulnerability-affecting-fortios-and-fortiproxy-cve-2023-33308/
• https://www.fortiguard.com/psirt/FG-IR-23-183
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33308

Contributing Authors

• Maximo Bredfeldt, vCISO
• Stephen Jones, VP Cybersecurity

View all Dataprise Defense Digests here.