CVE-2022-41327
📋 TL;DR
This vulnerability allows authenticated attackers with readonly superadmin privileges in Fortinet FortiOS and FortiProxy to intercept cleartext traffic and obtain other administrators' session cookies via diagnose CLI commands. This affects FortiOS versions 7.2.0-7.2.4 and 7.0.0-7.0.8, and FortiProxy versions 7.2.0-7.2.1 and 7.0.0-7.0.8.
💻 Affected Systems
- Fortinet FortiOS
- Fortinet FortiProxy
📦 What is this software?
Fortios by Fortinet
Fortios by Fortinet
Fortiproxy by Fortinet
Fortiproxy by Fortinet
Fortiproxy by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Attackers could hijack administrator sessions, gain full administrative access, and potentially compromise the entire network infrastructure.
Likely Case
Attackers with existing readonly superadmin access could escalate privileges to full administrative control by stealing session cookies.
If Mitigated
With proper network segmentation and monitoring, impact would be limited to the affected administrative interface with no lateral movement.
🎯 Exploit Status
Exploitation requires existing readonly superadmin credentials; uses built-in diagnose CLI commands.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiOS 7.2.5, 7.0.9; FortiProxy 7.2.2, 7.0.9
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-22-380
Restart Required: Yes
Instructions:
1. Download latest firmware from Fortinet support portal. 2. Backup configuration. 3. Upload firmware via GUI or CLI. 4. Reboot device. 5. Verify version after reboot.
🔧 Temporary Workarounds
Restrict CLI Access
allLimit diagnose CLI command access to only necessary administrators.
config system admin
edit <admin_user>
set accprofile "prof_admin"
end
Network Segmentation
allIsolate management interfaces from general network access.
🧯 If You Can't Patch
- Implement strict network segmentation for management interfaces
- Monitor and audit all CLI diagnostic command usage by readonly superadmin accounts
🔍 How to Verify
Check if Vulnerable:
Check FortiOS/FortiProxy version via CLI: get system status | grep VersionCheck Version:
get system status | grep VersionVerify Fix Applied:
Verify version is 7.2.5/7.0.9 or higher for FortiOS, or 7.2.2/7.0.9 or higher for FortiProxy📡 Detection & Monitoring
Log Indicators:
- Unusual diagnose CLI command usage by readonly superadmin accounts
- Multiple administrator session creations from same source
Network Indicators:
- Cleartext traffic containing session cookies on management interfaces
- Unexpected traffic interception patterns
SIEM Query:
source="fortigate" AND (command="diagnose" OR "cookie" OR "session")