FG-IR-23-328: Out-of-bounds Write in captive portal
First published: Tue Mar 12 2024(Updated: )
An out-of-bounds write vulnerability [CWE-787] and a Stack-based Buffer Overflow [CWE-121] in FortiOS & FortiProxy captive portal may allow an inside attacker who has access to captive portal to execute arbitrary code or commands via specially crafted HTTP requests.## Workaround:Set a non form-based authentication scheme:<br/>config authentication scheme<br/>edit scheme<br/>set method method<br/>next<br/>end<br/>Where <method> can be any of those :ntlm NTLM authentication.basic Basic HTTP authentication.digest Digest HTTP authentication.negotiate Negotiate authentication.fsso Fortinet Single Sign-On (FSSO) authentication.rsso RADIUS Single Sign-On (RSSO) authentication.ssh-publickey Public key based SSH authentication.cert Client certificate authentication.saml SAML authenticationNone of the enabled authentication schemes should be form-based.Please note that only devices with captive portal enabled are affected.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiOS | ||
| Fortinet FortiProxy | ||
| Fortinet FortiOS | >=7.4.0<=7.4.1 | |
| Fortinet FortiOS | >=7.2.0<=7.2.5 | |
| Fortinet FortiOS | >=7.0.0<=7.0.12 | |
| Fortinet FortiOS | >=6.4.0<=6.4.14 | |
| Fortinet FortiOS | >=6.2.0<=6.2.15 | |
| Fortinet FortiProxy | =. | |
| Fortinet FortiProxy | >=7.2.0<=7.2.6 | |
| Fortinet FortiProxy | >=7.0.0<=7.0.12 | |
| Fortinet FortiProxy | >=2.0.0<=2.0.13 | |
| Fortinet FortiSASE | =3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/last-modified-date
- agent/first-publish-date
- agent/type
- agent/severity
- agent/references
- agent/weakness
- agent/title
- agent/description
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/tags
- agent/softwarecombine
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2023-42789
- agent/event
- collector/fortiguard-psirt
- alias/CVE-2023-42790
- vendor/fortinet
- canonical/fortinet fortios
- version/fortinet fortios/7.4.0
- version/fortinet fortios/7.4.1
- version/fortinet fortios/7.2.0
- version/fortinet fortios/7.2.5
- version/fortinet fortios/7.0.0
- version/fortinet fortios/7.0.12
- version/fortinet fortios/6.4.0
- version/fortinet fortios/6.4.14
- version/fortinet fortios/6.2.0
- version/fortinet fortios/6.2.15
- canonical/fortinet fortiproxy
- version/fortinet fortiproxy/.
- version/fortinet fortiproxy/7.2.0
- version/fortinet fortiproxy/7.2.6
- version/fortinet fortiproxy/7.0.0
- version/fortinet fortiproxy/7.0.12
- version/fortinet fortiproxy/2.0.0
- version/fortinet fortiproxy/2.0.13
- canonical/fortinet fortisase
- version/fortinet fortisase/3