Security News > 2023 > February > Exploit released for critical Fortinet RCE flaws, patch now

Security researchers have released a proof-of-concept exploit for a critical-severity vulnerability in Fortinet's FortiNAC network access control suite.

Proof-of-concept exploit code is also available from the company's repository on GitHub.

The analysts discovered that the fix for CVE-2022-39952 removed 'keyUpload.jsp,' an endpoint that parses requests for a 'key' parameter, writes it on a config file, and then executes a bash script, 'configApplianceXml.

The bash script executes the 'unzip' command on the newly written file, but just before that, the script calls "Cd /.".

"Because the working directory is /, the call unzip inside the bash script allows any arbitrary file to be written," the researchers added.

The 'key' parameter ensures that the malicious request will reach 'keyUpload.jsp,' which is the unauthenticated endpoint that Fortinet removed in the fixed versions of FortiNAC. The code from Horizon3 automates this process and could be picked up and modified by threat actors into a weaponized exploit.

News URL

https://www.bleepingcomputer.com/news/security/exploit-released-for-critical-fortinet-rce-flaws-patch-now/