CVE-2022-40684

Description

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

CVSS breakdown

Affected products

• fortinet / Fortinet FortiOS, FortiProxy, FortiSwitchManagerFortiOS 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiProxy 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiSwitchManager 7.2.0, 7.0.0 – FortiOS 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiProxy 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiSwitchManager 7.2.0, 7.0.0
• fortinet / fortios7.0.0 – 7.0.7
• fortinet / fortiproxy7.0.0 – 7.0.7
• fortinet / fortiproxy7.2.0 – 7.2.0
• fortinet / fortiswitchmanager7.0.0 – 7.0.0
• fortinet / fortiswitchmanager7.2.0 – 7.2.0

Exploits & proofs of concept

• exploit-dbFortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypassby ub3rsick
• exploit-dbFortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypassby Felipe Alcantara
• nucleiFortiOS Admin Login Panel - Detectby canberbamber,Jna1
• nucleiFortinet - Authentication Bypassby Shockwave,nagli,carlosvieira

References

• VENDOR_ADVISORYhttps://fortiguard.com/psirt/FG-IR-22-377
• EXPLOIThttp://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html
• EXPLOIThttp://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html