Fortinet FortiWeb Relative Path Traversal Vulnerability Allowing Execution of Administrative Commands

A relative path traversal vulnerability has been identified in Fortinet FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11. This vulnerability may allow an unauthenticated attacker to execute administrative commands on the system by sending crafted HTTP or HTTPS requests.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of administrative commands on the affected system.

Reproduction

The vulnerability can be reproduced by sending crafted HTTP or HTTPS requests to the FortiWeb application. This can be automated with a Python script available on GitHub, which detects if FortiWeb is vulnerable to authentication bypass by exploiting the path traversal vulnerability.

Remediation

Users are advised to upgrade Fortinet FortiWeb to version 8.0.2 or above, 7.6.5 or above, 7.4.10 or above, 7.2.12 or above, or 7.0.12 or above, depending on their current version. Consult the Fortinet PSIRT for specific upgrade instructions.