FG-IR-25-647: Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass
An Improper Verification of Cryptographic Signature vulnerability[CWE-347] in FortiOS, FortiWeb, FortiProxy and FortiSwitchManager mayallow an unauthenticated attacker to bypass the FortiCloud SSO loginauthentication via a crafted SAML message, if that feature is enabled on the device. Please note that the FortiCloud SSO login feature is not enabled in default factory settings. However, when an administrator registers the device to FortiCare from the device's GUI, unless the administrator disables the toggle switch "Allow administrative login using FortiCloud SSO" in the registration page, FortiCloud SSO login is enabled upon registration. To prevent being affected by this vulnerability on vulnerableversions, please turn off the FortiCloud login feature (if enabled) temporarily untilupgrading to a non-affected version.To turn off FortiCloud login, go to System -> Settings -> Switch"Allow administrative login using FortiCloud SSO" to Off. Or type thefollowing command in the CLI: config system global set admin-forticloud-sso-login disableend
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-25-647?
The severity of FG-IR-25-647 is high due to its potential to allow unauthenticated access via a crafted SAML message.
How do I fix FG-IR-25-647?
To fix FG-IR-25-647, upgrade to the appropriate patched version of FortiOS, FortiWeb, FortiProxy or FortiSwitchManager as specified in the advisory.
Which versions of Fortinet products are affected by FG-IR-25-647?
FG-IR-25-647 affects multiple versions of FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, specifically those before the remedial versions listed in the advisory.
Can FG-IR-25-647 be exploited remotely?
Yes, FG-IR-25-647 can be exploited remotely by an unauthenticated attacker to bypass authentication.
What impacts does FG-IR-25-647 have on Fortinet devices?
FG-IR-25-647 allows an attacker to bypass the FortiCloud SSO login authentication, potentially leading to unauthorized access.