CVE-2021-44169
📋 TL;DR
This vulnerability allows attackers to gain administrative privileges on Windows systems running vulnerable FortiClient versions by placing a malicious executable in the FortiClient installer directory. It affects FortiClient for Windows across multiple versions. Attackers can escalate privileges from standard user to SYSTEM/administrator level access.
💻 Affected Systems
- Fortinet FortiClient for Windows
📦 What is this software?
Forticlient by Fortinet
Forticlient by Fortinet
Forticlient by Fortinet
Forticlient by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative privileges, enabling installation of persistent malware, data exfiltration, lateral movement, and full control of the affected system.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install additional malware, or access restricted system resources and data.
If Mitigated
Limited impact if proper access controls prevent unauthorized users from writing to FortiClient directories and least privilege principles are enforced.
🎯 Exploit Status
Requires local access to the system and ability to write to FortiClient directories. No authentication bypass needed beyond initial access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.11, 6.2.10, 6.4.8, 7.0.4 and above
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-21-238
Restart Required: Yes
Instructions:
1. Download latest FortiClient version from Fortinet support portal. 2. Uninstall current vulnerable version. 3. Install updated version. 4. Restart system to ensure proper initialization.
🔧 Temporary Workarounds
Restrict directory permissions
windowsSet strict ACLs on FortiClient installation directory to prevent unauthorized writes
icacls "C:\Program Files\Fortinet\FortiClient" /deny Users:(OI)(CI)W
Monitor directory changes
windowsEnable auditing on FortiClient directories to detect unauthorized file placement
auditpol /set /subcategory:"File System" /success:enable /failure:enable
🧯 If You Can't Patch
- Implement strict access controls on FortiClient directories to prevent unauthorized writes
- Monitor for suspicious file creation in FortiClient directories and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check FortiClient version via GUI (Help > About) or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\VersionCheck Version:
reg query "HKLM\SOFTWARE\Fortinet\FortiClient" /v VersionVerify Fix Applied:
Confirm version is 6.0.11+, 6.2.10+, 6.4.8+, or 7.0.4+ and test directory write permissions📡 Detection & Monitoring
Log Indicators:
- Unexpected file creation in FortiClient directories
- Privilege escalation events
- FortiClient service restart with unusual parent process
Network Indicators:
- Unusual outbound connections from FortiClient processes
- Lateral movement attempts from FortiClient hosts
SIEM Query:
EventID=4688 AND (NewProcessName LIKE '%forticlient%' OR ParentProcessName LIKE '%forticlient%') AND SubjectUserName NOT IN (authorized_users)