CVE-2022-43955
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to perform reflected cross-site scripting (XSS) attacks against FortiWeb web interfaces by injecting malicious payloads into log entries used for report generation. Attackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies or performing actions on behalf of authenticated users. All FortiWeb versions from 6.0 through 7.0.3 are affected.
💻 Affected Systems
- FortiWeb Web Application Firewall
📦 What is this software?
Fortiweb by Fortinet
Fortiweb by Fortinet
Fortiweb by Fortinet
Fortiweb by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full administrative access to FortiWeb, reconfigure security policies, disable protections, and pivot to internal networks.
Likely Case
Attackers steal user session cookies, perform actions as authenticated users, or redirect users to malicious sites for credential harvesting.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized, preventing successful exploitation.
🎯 Exploit Status
Exploitation requires tricking users into clicking malicious links. No authentication is required to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.4, 6.3.22, and later versions
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-22-428
Restart Required: Yes
Instructions:
1. Log into FortiWeb web interface as administrator. 2. Navigate to System > Dashboard > Status. 3. Check current firmware version. 4. Download appropriate firmware from Fortinet support portal. 5. Navigate to System > Maintenance > Firmware. 6. Upload and install new firmware. 7. Reboot device after installation completes.
🔧 Temporary Workarounds
Disable Web Interface
allTemporarily disable the FortiWeb web interface to prevent exploitation while planning patching.
config system interface
edit port1
set allowaccess ping https ssh
next
end
Restrict Web Interface Access
allLimit web interface access to trusted IP addresses only using firewall rules.
config firewall address
edit "trusted_admin"
set subnet 192.168.1.0 255.255.255.0
next
end
config firewall policy
edit 1
set srcintf port1
set dstintf port1
set srcaddr "trusted_admin"
set dstaddr all
set service HTTPS
set action accept
next
end
🧯 If You Can't Patch
- Implement web application firewall rules to block XSS payloads in log entries.
- Deploy network segmentation to isolate FortiWeb management interface from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Check FortiWeb firmware version via web interface: System > Dashboard > Status. If version is within affected ranges, system is vulnerable.Check Version:
get system statusVerify Fix Applied:
After patching, verify firmware version shows 7.0.4+, 6.3.22+, or later. Test by attempting to inject basic XSS payloads into log entries and checking if they're properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript or HTML injection attempts in web interface logs
- Multiple failed login attempts followed by successful login from new IP
- Unexpected report generation requests with suspicious parameters
Network Indicators:
- HTTP requests containing script tags or JavaScript in URL parameters to FortiWeb interface
- Outbound connections from FortiWeb to unexpected external domains
SIEM Query:
source="fortiweb" AND (url="*<script*" OR url="*javascript:*" OR url="*onerror=*" OR url="*onload=*")