IR Number FG-IR-17-245
Date May 18, 2018
Severity light-circle-logo light-circle-logo light-circle-logo light-circle-logo light-circle-logo Medium
Impact Local Privilege Escalation
CVE ID CVE-2017-14187
Affected Products
FortiOS : 5.6.2, 5.6.1, 5.6.0, 5.4.8, 5.4.7, 5.4.6, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.1, 5.4.0, 5.2.9, 5.2.8, 5.2.7, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.15, 5.2.14, 5.2.13, 5.2.12, 5.2.11, 5.2.10, 5.2.1, 5.2.0
CVRF Download

PSIRT Advisories

FortiOS local privilege escalation via malicious use of USB storage devices

Summary

An admin user with super_admin privileges can execute an arbitrary binary contained on an USB drive plugged to a FortiGate, via linking the aforementioned binary to a command that is allowed to be run by the fnsysctl CLI command.

Affected Products

FortiOS 5.6.0 to 5.6.2
FortiOS 5.4.0 to 5.4.8
FortiOS 5.2 and below.

Solutions

Upgrade to 5.6.3 or 5.4.9 or newer versions.

Workarounds

* Switching to FIPS mode will ban the fnsysctl CLI command hence preventing the attack.

* Only the super_admin profile has the privileges required to perform the attack, so avoid assigning it to administrators.

Acknowledgement

Fortinet is pleased to thank Shaanan Cohney of University of Pennsylvania for reporting this vulnerability under responsible disclosure.