FortiWeb vulnerabilities

An Improper Authentication vulnerability (CWE-287) in Fortinet FortiWeb versions 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.11, 7.2.0-7.2.12, 7.0.0-7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password.

An out-of-bounds write vulnerability in Fortinet FortiWeb versions 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11 allows a remote privileged attacker to execute arbitrary code or commands via crafted HTTP requests.

FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11 rely on cookies without validation and integrity checking. An unauthenticated attacker may execute arbitrary operations on the system via crafted HTTP or HTTPS requests using forged cookies, requiring prior knowledge of the FortiWeb serial number.

Fortinet FortiWeb versions 8.0.0-8.0.2, 7.6.0-7.6.5, 7.4 (all), 7.2 (all), and 7.0 (all) have an incomplete list of disallowed inputs vulnerability, which may allow an attacker to cause improper access control.

Multiple Relative Path Traversal vulnerabilities [CWE-23] in Fortinet FortiWeb may allow a local privileged attacker to execute unauthorized code on the underlying system via crafted CLI commands.

An OS command injection vulnerability in Fortinet FortiWeb (versions 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.11, 7.2.0-7.2.12, 7.0.0-7.0.12) stems from improper neutralization of special elements in OS commands. An authenticated attacker may execute arbitrary commands via a specially crafted HTTP request.

A use of password hash instead of password for authentication vulnerability [CWE-836] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to use the hash in place of the password to authenticate via crafted HTTP/HTTPS requests.

Fortinet FortiWeb versions 7.6.0, 7.4, 7.2, and 7.0 contain a use of hard-coded credentials vulnerability. An authenticated attacker with shell access can connect to the Redis service and access its data.