CVE-2021-26089: FortiClientMac - Privilege escalation by abusing a Symlink following vulnerability
A UNIX symbolic link (Symlink) Following (CWE-61) vulnerability in FortiClient for MacOS may allow a local and unprivileged user to overwrite privileged shell scripts executed during the installation phase via escalating their privileges to root.
Other sources
An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during installation phase.
This vulnerability allows local attackers to escalate privileges on affected installations of Fortinet FortiClient Network Access Control. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Network Access Control service. The service loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-26089?
The severity of CVE-2021-26089 is high, with a CVSS score of 7.8.
What is the vulnerability description for CVE-2021-26089?
CVE-2021-26089 is a privilege escalation vulnerability in Fortinet FortiClient Network Access Control, allowing local attackers to escalate privileges on affected installations.
How can this vulnerability be exploited?
To exploit CVE-2021-26089, an attacker must first execute low-privileged code on the target system.
Which versions of Fortinet FortiClient are affected by CVE-2021-26089?
Fortinet FortiClient versions up to and including 6.4.3 on macOS are affected by CVE-2021-26089.
Where can I find more information about CVE-2021-26089?
You can find more information about CVE-2021-26089 on the FortiGuard advisory and Zero Day Initiative advisories.