FortiADC 3.2 Cross Site Scripting

`I. VULNERABILITY  
  
-------------------------  
  
XSS Reflected vulnerabilities in OS of FortiADC v3.2  
  
  
  
II. BACKGROUND  
  
-------------------------  
  
Fortinet's industry-leading, Network Security Platforms deliver Next  
Generation Firewall (NGFW) security with exceptional throughput, ultra  
low latency, and multi-vector threat protection.  
  
  
  
III. DESCRIPTION  
  
-------------------------  
  
Has been detected a XSS Reflected vulnerability in FortiADC in  
"/FortiADC/gui_partA/?locale=en" parameter "locale", that allows the  
execution of arbitrary HTML/script code to be executed in the context  
of the victim user's browser and/or Session Hijacking attack  
  
  
  
IV. PROOF OF CONCEPT  
  
-------------------------  
  
The application does not validate the parameter filter in "  
/FortiADC/gui_partA/?locale=en ".  
  
https://IP_FortiADC/FortiADC/gui_partA/?locale=en"><https://IP_FortiADC/FortiADC/gui_partA/?locale=aaaa></script>  
--><script>alert(document.cookie);</script>  
  
  
  
V. BUSINESS IMPACT  
  
-------------------------  
  
That allows the execution attackers to hijack the authentication of  
administrators.  
  
  
  
VI. REQUIREMENTS  
  
-----------------------  
  
An Attacker needs to know the IP of the device.  
  
An Administrator needs an authenticated connection to the device.  
  
  
  
VII. SYSTEMS AFFECTED  
  
-------------------------  
  
FortiADC 3.2.0 and lower.  
  
  
VIII. SOLUTION  
  
-------------------------  
  
Upgrade to FortiADC 3.2.1 or higher.  
  
IX. References  
  
-------------------------  
http://www.fortiguard.com/advisory/FG-IR-14-004/  
  
By William Costa.  
  
  
`