FortiOS & FortiProxy: authenticated user null pointer dereference in SSL-VPN

Summary

A NULL pointer dereference vulnerability [CWE-476] in SSL-VPN may allow an authenticated remote attacker to trigger a crash of the SSL-VPN service via crafted requests.

Affected Products

FortiOS version 7.2.0 through 7.2.4
FortiOS version 7.0.0 through 7.0.10
FortiOS version 6.4.0 through 6.4.12
FortiProxy version 7.2.0 through 7.2.3
FortiProxy version 7.0.0 through 7.0.9

Solutions

Please upgrade to FortiOS version 7.4.0 or above
Please upgrade to FortiOS version 7.2.5 or above
Please upgrade to FortiOS version 7.0.11 or above
Please upgrade to FortiOS version 6.4.13 or above
Please upgrade to FortiProxy version 7.2.4 or above
Please upgrade to FortiProxy version 7.0.10 or above

Acknowledgement

Fortinet thanks to Aliz Hammond of watchTowr and NimdaKey of 360 Noah Lab for reporting this vulnerability.

Timeline

2023-06-14: Initial publication