CVE-2023-42790: Out-of-bounds Write in captive portal
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiProxy 7.2.0 through 7.2.6, FortiProxy 7.0.0 through 7.0.12, FortiProxy 2.0.0 through 2.0.13, FortiSASE 23.2.b allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.
Other sources
An out-of-bounds write vulnerability [CWE-787] and a Stack-based Buffer Overflow [CWE-121] in FortiOS & FortiProxy captive portal may allow an inside attacker who has access to captive portal to execute arbitrary code or commands via specially crafted HTTP requests.
Workaround:
Set a non form-based authentication scheme:
config authentication schemeedit schemeset method methodnextend
Where <method> can be any of those :
ntlm NTLM authentication.basic Basic HTTP authentication.digest Digest HTTP authentication.negotiate Negotiate authentication.fsso Fortinet Single Sign-On (FSSO) authentication.rsso RADIUS Single Sign-On (RSSO) authentication.ssh-publickey Public key based SSH authentication.cert Client certificate authentication.saml SAML authentication
None of the enabled authentication schemes should be form-based.
Please note that only devices with captive portal enabled are affected.
— FortiGuard
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 6.2.16 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 6.4.15 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.0.13 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.4.2 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 2.0.14 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.0.13 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.2.7 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.4.1 - Upgrade
Upgrade
FortiPAMto a version that resolves this vulnerability.Fixed in 1.2.0 - Upgrade
Upgrade
FortiSwitchManagerto a version that resolves this vulnerability.Fixed in 7.0.3 - Upgrade
Upgrade
FortiSwitchManagerto a version that resolves this vulnerability.Fixed in 7.2.3 - Configuration
For captive portal, set a non form-based authentication scheme by editing authentication scheme and setting 'method' to one of the allowed non-form-based methods: ntlm, basic, digest, negotiate, fsso (FSSO), rsso (RSSO), ssh-publickey, cert (client certificate), or saml.
FortiOS / FortiProxy captive portal authentication scheme method = Workaround: set method to one of: ntlm, basic, digest, negotiate, fsso, rsso, ssh-publickey, cert, saml
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-42790?
CVE-2023-42790 has a critical severity rating due to its potential for remote code execution.
How do I fix CVE-2023-42790?
To fix CVE-2023-42790, upgrade FortiOS to version 7.4.2 or later, FortiProxy to version 7.4.1 or later, or apply the relevant patches for affected versions.
Which software versions are affected by CVE-2023-42790?
CVE-2023-42790 affects multiple versions of Fortinet FortiOS and FortiProxy, specifically across various versions listed in the CVE description.
What kind of attack can exploit CVE-2023-42790?
CVE-2023-42790 can be exploited by an attacker to execute unauthorized code on the affected FortiOS and FortiProxy devices.
What products does CVE-2023-42790 impact?
CVE-2023-42790 impacts Fortinet FortiOS and FortiProxy across multiple version ranges as outlined in the vulnerability details.