CVE-2023-22635
📋 TL;DR
This vulnerability in FortiClient for macOS allows local attackers to escalate privileges by modifying the installer during an upgrade process. It affects all versions of FortiClientMac from 4.0 through 7.0.7 due to missing integrity checks on downloaded code.
💻 Affected Systems
- FortiClient for macOS
📦 What is this software?
Forticlient by Fortinet
Forticlient by Fortinet
Forticlient by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root privileges on the macOS system, enabling complete system compromise, data theft, and persistence.
Likely Case
Malicious local user or malware with user-level access escalates to administrative privileges to install additional malware or access sensitive data.
If Mitigated
With proper access controls and monitoring, impact is limited to isolated systems with quick detection and remediation.
🎯 Exploit Status
Exploitation requires local access and ability to modify installer files during upgrade process.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiClientMac 7.0.8 and later
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-22-481
Restart Required: Yes
Instructions:
1. Download FortiClientMac 7.0.8 or later from Fortinet support portal. 2. Uninstall current FortiClient. 3. Install the updated version. 4. Restart the system.
🔧 Temporary Workarounds
Disable automatic updates
macOSPrevent automatic upgrades that could be intercepted and modified
sudo defaults write /Library/Preferences/com.fortinet.FortiClient AutoUpdate -bool false
Restrict local user privileges
macOSLimit which users can modify system files and install software
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Monitor for unauthorized privilege escalation attempts and installer modifications
🔍 How to Verify
Check if Vulnerable:
Check FortiClient version: Open FortiClient → About. If version is between 4.0-7.0.7, system is vulnerable.Check Version:
defaults read /Applications/FortiClient.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
Verify FortiClient version is 7.0.8 or later. Check that integrity verification is enabled in settings.📡 Detection & Monitoring
Log Indicators:
- Unauthorized privilege escalation events
- Modifications to FortiClient installer files
- Unexpected process execution with elevated privileges
Network Indicators:
- Unusual outbound connections during FortiClient updates
SIEM Query:
source="macos" AND (event="privilege_escalation" OR process="FortiClient" AND action="modify")