Fortinet FortiWeb SSO authentication bypass (FG-IR-26-060)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(297164);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/29");

  script_cve_id("CVE-2026-24858");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/01/30");
  script_xref(name:"IAVA", value:"2026-A-0093");

  script_name(english:"Fortinet FortiWeb SSO authentication bypass (FG-IR-26-060)");

  script_set_attribute(attribute:"synopsis", value:
"Fortinet Firewall is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a
vulnerability as referenced in the FG-IR-26-060 advisory.

  - An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS,
    FortiManager, FortiAnalyzer may allow an attacker with a FortiCloud account and a registered device to log
    into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those
    devices. (CVE-2026-24858)

  - An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in
    Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through
    7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through
    7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5,
    FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0
    through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through
    7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may
    allow an attacker with a FortiCloud account and a registered device to log into other devices registered
    to other accounts, if FortiCloud SSO authentication is enabled on those devices. (CVE-2026-24858)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.fortiguard.com/psirt/FG-IR-26-060");
  # https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e1fd8e2e");
  script_set_attribute(attribute:"solution", value:
"For 7.4.x, upgrade to FortiWeb version 7.4.12 or later. For 7.6.x, upgrade to FortiWeb version 7.6.7 or later. For
8.0.x, upgrade to FortiWeb version 8.0.4 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-24858");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/29");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:fortinet:fortiweb");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Firewalls");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("fortinet_version.nbin");
  script_require_keys("Host/Fortigate/model", "Host/Fortigate/version", "Settings/ParanoidReport");

  exit(0);
}

include('vcf_extras_fortios.inc');

# Since there's a workaround specified in the advisory, we're making this require paranoid.
if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_name = 'FortiWeb';
var app_info = vcf::get_app_info(app:app_name, kb_ver:'Host/Fortigate/version');
vcf::fortios::verify_product_and_model(product_name:app_name);

var constraints = [
  { 'min_version' : '7.4.0', 'max_version' : '7.4.11.999999', 'fixed_version' : '7.4.12', 'fixed_display' : 'Upgrade to upcoming 7.4.12 or above' },
  { 'min_version' : '7.6.0', 'max_version' : '7.6.6.999999', 'fixed_version' : '7.6.7', 'fixed_display' : 'Upgrade to upcoming 7.6.7 or above' },
  { 'min_version' : '8.0.0', 'max_version' : '8.0.3.999999', 'fixed_version' : '8.0.4', 'fixed_display' : 'Upgrade to upcoming 8.0.4 or above' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);