Plan ahead High Patch available CVSS 8.4
FortiManager flaw lets low-privilege admin take over managed FortiGates
Fortinet PSIRTFortinet, FortiManager, FortiGate
What happened. Fortinet reports a template engine flaw in FortiManager and FortiManager Cloud, rated 8.4. A low-privileged Device Manager admin may gain super admin privilege on managed FortiGates by injecting malicious commands.
Who is affected. Users of Fortinet FortiManager and FortiManager Cloud, and the FortiGate firewalls they manage. The source gives no versions.
What to do. Check whether you run FortiManager and apply the fixed version from the Fortinet advisory.
When to act. Plan ahead: Firewall and gateway owners: a low-privilege user could gain super admin on managed FortiGates; plan the fix.
Editor's reading
Forasset ownerIT security
- Purdue level
- L4
- L3.5
Why: FortiManager controls firewalls that often sit at the boundary between enterprise IT and plant networks, so it sits at the industrial DMZ and enterprise levels. This is inferred.
- Are you exposed?
Check the inventory for FortiManager and FortiManager Cloud instances and list which admin accounts hold Device Manager rights.
- If you cannot fix it yet
- Limit Device Manager admin accounts to the few people who need them.
- Restrict access to the FortiManager interface to trusted management hosts.
- Watch for
- Configuration or script changes pushed to FortiGates by low-privileged Device Manager accounts.
- New super admin accounts or privilege changes on managed FortiGates.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Fortinet PSIRT (opens fortiguard.fortinet.com)
More on Fortinet