PoC exploit code for important Fortinet FortiNAC bug launched onlineSecurity Affairs | Mind Tech

Researchers launched proof-of-concept exploit code for the important CVE-2022-39952 vulnerability within the Fortinet FortiNAC community entry management answer.

Researchers at cybersecurity agency Horizon3 have launched a proof-of-concept exploit for a important severity vulnerability, tracked as CVE-2022-39952in Fortinet’s FortiNAC community entry management answer.

Final week, Fortinet launched safety updates to handle two important vulnerabilities within the FortiNAC and FortiWeb options.

The 2 vulnerabilities, tracked as CVE-2022-39952 and CVE-2021-42756, are respectively an exterior management of filename or path in Fortinet FortiNAC and a group of stack-based buffer overflow points within the daemon. FortiWeb proxy.

The CVE-2022-39952 (CVSS rating 9.8) flaw is an exterior management of the file title or path within the FortiNAC keyUpload scriptlet. The vulnerability was found and reported internally by Gwendal Guégniaud of Fortinet’s product safety workforce.

“An exterior management of the file title or path vulnerability [CWE-73]on the FortiNAC internet server could enable an unauthenticated attacker to carry out an arbitrary write to the system.” learn the discover.

The affected merchandise are:

FortiNAC model 9.4.0
FortiNAC model 9.2.0 to 9.2.5
FortiNAC model 9.1.0 to 9.1.7
FortiNAC 8.8 all variations
FortiNAC 8.7 all variations
FortiNAC 8.6 all variations
FortiNAC 8.5 all variations
FortiNAC 8.3 all variations

The CVE-2022-39952 vulnerability is fastened in FortiNAC 9.4.1 and later, 9.2.6 and later, 9.1.8 and later, and seven.2.0 and later.

At this time, Horizon3 shared technical particulars in regards to the vulnerability together with indicators of compromise (IoC) and a proof-of-concept (PoC) exploit code.

The researchers extracted each file programs from the patched and susceptible vmdks, noting that the file /bsc/campusMgr/ui/ROOT/configWizard/keyUpload.jsp it was eliminated within the patch.

The title of the javascript, KeyUpload, can be reported within the title (“Exterior management of filename or path in keyUpload scriptlet”) of the unique discover posted by the supplier.

“This POC abuses the keyUpload.jsp endpoint to realize arbitrary file writing.” learn the PoC description.

The PoC exploit code writes a cron job to /and so forth/cron.d/ that creates a reverse shell each minute.

“Just like the weaponry of earlier file vulnerability points that enable arbitrary writing of information, we use this vulnerability to write down a cron job to /and so forth/cron.d/payload. This cron job fires each minute and begins a reverse shell for the attacker.” learn the technical analysis of the vulnerability published by Horizon3.” First we create a zip containing an archive and specify the path we want it to be extracted to. We then send the malicious zip file to the vulnerable endpoint in the key field. In a minute, we get a reverse shell as the root user. Our proof-of-concept exploit that automates this can be found on our GitHub.”

Analysis of keyUpload.jsp revealed that the unauthenticated endpoint will parse requests that provide a file in the key parameter. If found, the script writes the file to /bsc/campusMgr/config.applianceKey before calling Runtime().Exec() executes a bash script located at /bsc/campusMgr/bin/configApplianceXml.

The bash script runs the unzip command on the file just written, then calls “cd /”.

“Unzip will allow files to be placed in any path as long as they do not traverse above the current working directory. Because the working directory is /, the unzip call within the bash script allows any arbitrary file to be written. analysis continues.

In an attack scenario, a threat actor can send the vulnerable endpoint, using the key parameter, a specially crafted ZIP file containing a malicious payload that can be extracted at a specific location.

Administrators are urged to immediately address their facilities due to the availability of PoC exploit code.

Follow me on twitter: @safetyissues and Fb and Mastodon

Pierluigi Paganini

(Safety Points – hacking, Fortinet FortiNAC)

---

share on