CVE-2023-42789: Out-of-bounds Write in captive portal
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiProxy 7.2.0 through 7.2.6, FortiProxy 7.0.0 through 7.0.12, FortiProxy 2.0.0 through 2.0.13, FortiSASE 23.2.b allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.
Other sources
An out-of-bounds write vulnerability [CWE-787] and a Stack-based Buffer Overflow [CWE-121] in FortiOS & FortiProxy captive portal may allow an inside attacker who has access to captive portal to execute arbitrary code or commands via specially crafted HTTP requests.
Workaround:
Set a non form-based authentication scheme:
config authentication schemeedit schemeset method methodnextend
Where <method> can be any of those :
ntlm NTLM authentication.basic Basic HTTP authentication.digest Digest HTTP authentication.negotiate Negotiate authentication.fsso Fortinet Single Sign-On (FSSO) authentication.rsso RADIUS Single Sign-On (RSSO) authentication.ssh-publickey Public key based SSH authentication.cert Client certificate authentication.saml SAML authentication
None of the enabled authentication schemes should be form-based.
Please note that only devices with captive portal enabled are affected.
— FortiGuard
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 6.2.16 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 6.4.15 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.0.13 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.4.2 - Upgrade
Upgrade
FortiPAMto a version that resolves this vulnerability.Fixed in 1.2.0 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 2.0.14 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.0.13 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.2.7 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.4.1 - Upgrade
Upgrade
FortiSwitchManagerto a version that resolves this vulnerability.Fixed in 7.0.3 - Upgrade
Upgrade
FortiSwitchManagerto a version that resolves this vulnerability.Fixed in 7.2.3 - Configuration
For devices with captive portal enabled, set a non form-based authentication scheme by running: config authentication scheme; edit schemes; set method <method>; next. Use one of: ntlm, basic, digest, negotiate, fsso (FSSO), rsso (RSSO), ssh-publickey, cert (client certificate), saml.
FortiOS/FortiProxy captive portal authentication scheme config authentication scheme -> edit schemeset method = Workaround: set method to a non form-based authentication method (e.g., ntlm, basic, digest, negotiate, fsso, rsso, ssh-publickey, cert, saml)
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-42789?
CVE-2023-42789 is considered critical due to its potential to allow unauthorized code execution.
How do I fix CVE-2023-42789?
To remediate CVE-2023-42789, upgrade FortiOS to version 7.4.2 or later, or FortiProxy to version 7.4.1 or later.
Which versions are affected by CVE-2023-42789?
CVE-2023-42789 affects FortiOS versions 6.2.0 to 7.4.1 and FortiProxy versions 2.0.0 to 7.4.0.
Can CVE-2023-42789 lead to data breaches?
Yes, exploitation of CVE-2023-42789 can lead to severe security breaches and unauthorized access to sensitive information.
Are there any workarounds for CVE-2023-42789?
There are no effective workarounds for CVE-2023-42789; updating to the patched versions is the recommended action.