CVE-2021-24016: Excel formula injection in P&O IPv4 Policy names Vulnerability
An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.
Other sources
An improper neutralization of formula elements vulnerability (CWE 1236) in FortiManager may allow a local authenticated privileged attacker to execute arbitrary shell code on the end-user's host via inserting CSV formula in the policy names. This is achieved once the user downloads and opens the configuration csv/xls file.
— FortiGuard
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24016?
CVE-2021-24016 is an vulnerability in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below that allows an attacker to execute arbitrary commands via a crafted IPv4 field in a policy name when exported as an Excel file and opened unsafely on the victim host.
What is the severity of CVE-2021-24016?
CVE-2021-24016 has a severity rating of 6.3, which is classified as critical.
How does CVE-2021-24016 affect Fortinet FortiManager?
CVE-2021-24016 affects Fortinet FortiManager versions 6.4.3 and below, 6.2.7 and below.
How can an attacker exploit CVE-2021-24016?
An attacker can exploit CVE-2021-24016 by crafting a malicious IPv4 field in a policy name, exporting it as an Excel file, and tricking the victim into opening it unsafely.
Is there a fix available for CVE-2021-24016?
Fortinet has released a fix for CVE-2021-24016 in FortiManager version 6.4.4 and FortiManager version 6.2.8.