CVE-2023-41840
📋 TL;DR
This CVE describes a DLL hijacking vulnerability in Fortinet FortiClient for Windows where an attacker can place a malicious OpenSSL engine library in a search path location. This allows execution of arbitrary code with the privileges of the FortiClient process. Only users running FortiClient 7.0.9 on Windows systems are affected.
💻 Affected Systems
- Fortinet FortiClient
📦 What is this software?
Forticlient by Fortinet
Forticlient by Fortinet
Forticlient by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through privilege escalation if FortiClient runs with elevated privileges, allowing attacker to install persistent malware, steal credentials, or pivot to other systems.
Likely Case
Local attacker gains code execution with user-level privileges, enabling data theft, surveillance, or lateral movement within the network.
If Mitigated
Attack limited to user-level access if FortiClient runs with standard user privileges and proper endpoint protection is in place.
🎯 Exploit Status
Requires local access to plant malicious DLL and knowledge of FortiClient's library search paths. No public exploit code has been released.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.10 or later
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-23-274
Restart Required: Yes
Instructions:
1. Download FortiClient 7.0.10 or later from Fortinet support portal. 2. Uninstall current FortiClient version. 3. Install updated version. 4. Restart system to ensure all components load properly.
🔧 Temporary Workarounds
Restrict DLL search paths
windowsUse Windows policies or application control to restrict where FortiClient can load DLLs from
Using AppLocker or Windows Defender Application Control to block DLL loading from untrusted directories
Remove write permissions from search paths
windowsRemove write permissions for standard users from directories FortiClient searches for OpenSSL libraries
icacls "C:\Program Files\Fortinet\FortiClient" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Implement strict application control policies to prevent execution of unauthorized DLLs
- Monitor for suspicious DLL loading events and file creation in FortiClient directories
🔍 How to Verify
Check if Vulnerable:
Check FortiClient version in About dialog or via 'FortiClient.exe --version' commandCheck Version:
"C:\Program Files\Fortinet\FortiClient\FortiClient.exe" --versionVerify Fix Applied:
Verify installed version is 7.0.10 or higher and check Windows Event Logs for successful FortiClient startup📡 Detection & Monitoring
Log Indicators:
- Windows Event ID 4688 showing FortiClient loading DLLs from unusual paths
- Sysmon Event ID 7 (Image loaded) showing DLLs loaded by FortiClient from non-standard locations
Network Indicators:
- Unusual outbound connections from FortiClient process after DLL load
SIEM Query:
source="windows" AND (event_id=4688 OR event_id=7) AND process_name="FortiClient.exe" AND (file_path NOT CONTAINS "C:\\Program Files\\Fortinet\\FortiClient\\" OR file_extension="dll")