CVE-2021-32585
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in FortiWAN allows attackers to inject malicious scripts into web pages via crafted HTTP requests. When users view these compromised pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. Organizations running vulnerable FortiWAN versions are affected.
💻 Affected Systems
- FortiWAN
📦 What is this software?
Fortiwan by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack sessions, deploy malware to users' browsers, or pivot to internal network resources.
Likely Case
Session hijacking, credential theft, or defacement of the FortiWAN management interface.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though stored XSS remains dangerous.
🎯 Exploit Status
Exploitation requires ability to send HTTP requests to the FortiWAN interface; stored XSS payloads persist until cleaned.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.9 and later
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-21-078
Restart Required: Yes
Instructions:
1. Backup configuration. 2. Download FortiWAN 4.5.9 or later from Fortinet support portal. 3. Upload and apply firmware update via web interface or CLI. 4. Reboot device.
🔧 Temporary Workarounds
Input Validation and Output Encoding
allImplement server-side validation and encoding for user inputs in web applications.
Restrict Access to Management Interface
allLimit access to FortiWAN web interface to trusted IPs/networks.
Configure firewall rules to allow only specific source IPs to TCP/443 (HTTPS) on FortiWAN.
🧯 If You Can't Patch
- Isolate FortiWAN management interface to a dedicated VLAN with strict access controls.
- Implement a web application firewall (WAF) with XSS protection rules in front of FortiWAN.
🔍 How to Verify
Check if Vulnerable:
Check FortiWAN firmware version via web interface (System > Status) or CLI command 'get system status'.Check Version:
get system status | grep VersionVerify Fix Applied:
Confirm version is 4.5.9 or higher; test input fields for XSS payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to FortiWAN web endpoints with script tags or JavaScript in parameters.
Network Indicators:
- HTTP traffic to FortiWAN containing XSS payload patterns (e.g., <script>, javascript:).
SIEM Query:
source="fortiwan" AND (http_method="POST" AND url="*" AND (body="*<script>*" OR body="*javascript:*"))