CVE-2021-36183
📋 TL;DR
This vulnerability allows a local unprivileged attacker on Windows systems running vulnerable FortiClient versions to escalate privileges to SYSTEM level by exploiting improper authorization in the named pipe used for updates. This affects FortiClient for Windows versions 7.0.1 and below, and 6.4.2 and below.
💻 Affected Systems
- FortiClient for Windows
📦 What is this software?
Forticlient by Fortinet
Forticlient by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling installation of malware, data theft, persistence mechanisms, and lateral movement across the network.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install unauthorized software, and access sensitive system resources.
If Mitigated
Limited impact if proper endpoint protection and least privilege principles are enforced, though local access still poses risk.
🎯 Exploit Status
Exploitation requires local access but is relatively straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiClient 7.0.2 and 6.4.3
Vendor Advisory: https://fortiguard.com/advisory/FG-IR-20-079
Restart Required: Yes
Instructions:
1. Download FortiClient 7.0.2 or 6.4.3 from Fortinet support portal. 2. Uninstall current FortiClient version. 3. Install the patched version. 4. Restart the system.
🔧 Temporary Workarounds
Restrict Named Pipe Access
windowsModify Windows security settings to restrict access to the FortiClient update named pipe
icacls \\.\pipe\FortiClientUpdate /deny Everyone:(F)
Disable FortiClient Update Service
windowsTemporarily disable the FortiClient update service to prevent exploitation
sc config FortiClientUpdateService start= disabled
sc stop FortiClientUpdateService
🧯 If You Can't Patch
- Implement strict least privilege principles to limit local user access
- Deploy endpoint detection and response (EDR) solutions to monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check FortiClient version in About dialog or via 'wmic product get name,version' and compare to affected versionsCheck Version:
wmic product where "name like 'FortiClient%'" get name,versionVerify Fix Applied:
Verify FortiClient version is 7.0.2 or higher, or 6.4.3 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual process creation with SYSTEM privileges from non-admin users
- Access attempts to FortiClient named pipes from unauthorized processes
Network Indicators:
- Local named pipe communication anomalies
SIEM Query:
EventID=4688 AND NewProcessName LIKE '%FortiClient%' AND SubjectUserName NOT IN ('SYSTEM', 'Administrator')