CVE-2023-41673
📋 TL;DR
An improper authorization vulnerability in Fortinet FortiADC allows low-privileged users to read or backup the full system configuration via HTTP/HTTPS requests. This exposes sensitive configuration data, potentially including credentials and network details. Affected versions are FortiADC 7.4.0 and before 7.2.2.
💻 Affected Systems
- Fortinet FortiADC
📦 What is this software?
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full system configuration, enabling credential theft, network mapping, and further attacks like privilege escalation or lateral movement.
Likely Case
Low-privileged users or attackers with initial access exfiltrate configuration data, compromising security settings and sensitive information.
If Mitigated
With proper access controls and patching, impact is limited to unauthorized configuration viewing, but no direct system compromise.
🎯 Exploit Status
Exploitation requires low-privileged user access; no public proof-of-concept is known, but the vulnerability is straightforward to abuse.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiADC 7.2.2 or later, and 7.4.1 or later
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-23-270
Restart Required: Yes
Instructions:
1. Access the FortiADC management interface. 2. Navigate to System > Dashboard > Status. 3. Check current version. 4. If vulnerable, upgrade to FortiADC 7.2.2 or later, or 7.4.1 or later. 5. Restart the device after upgrade.
🔧 Temporary Workarounds
Restrict Access to Management Interface
allLimit HTTP/HTTPS access to the FortiADC management interface to trusted IP addresses only.
Configure firewall rules or ACLs to allow management access from specific IPs.
Enforce Least Privilege
allReview and minimize user privileges to reduce the number of low-privileged accounts with access.
Use FortiADC user management to restrict permissions to necessary functions only.
🧯 If You Can't Patch
- Monitor logs for unauthorized configuration access attempts and investigate anomalies.
- Isolate FortiADC from untrusted networks and implement network segmentation to limit exposure.
🔍 How to Verify
Check if Vulnerable:
Check the FortiADC version via the web interface or CLI; if version is 7.4.0 or before 7.2.2, it is vulnerable.Check Version:
get system statusVerify Fix Applied:
After patching, confirm the version is 7.2.2 or later, or 7.4.1 or later, and test that low-privileged users cannot access full configuration.📡 Detection & Monitoring
Log Indicators:
- Log entries showing configuration backup or read actions by low-privileged users.
- Unusual HTTP/HTTPS requests to configuration endpoints from unauthorized accounts.
Network Indicators:
- HTTP/HTTPS traffic to FortiADC management ports (e.g., 80, 443) from unexpected sources.
SIEM Query:
source="fortiadc" AND (event_type="config_read" OR event_type="backup") AND user_privilege="low"