CVE-2023-45583
📋 TL;DR
This CVE describes a format string vulnerability in multiple Fortinet products that allows attackers to execute arbitrary code or commands. The vulnerability affects FortiProxy, FortiPAM, FortiOS, and FortiSwitchManager across multiple versions. Attackers can exploit this via specially crafted CLI commands or HTTP requests.
💻 Affected Systems
- FortiProxy
- FortiPAM
- FortiOS
- FortiSwitchManager
📦 What is this software?
Fortios by Fortinet
Fortios by Fortinet
Fortios by Fortinet
Fortios by Fortinet
Fortios by Fortinet
Fortios by Fortinet
Fortipam by Fortinet
Fortipam by Fortinet
Fortiproxy by Fortinet
Fortiproxy by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root/admin privileges, allowing complete control over affected devices, data exfiltration, and lateral movement within the network.
Likely Case
Unauthorized command execution leading to configuration changes, data access, or installation of backdoors on vulnerable devices.
If Mitigated
Limited impact due to network segmentation, proper access controls, and monitoring preventing successful exploitation.
🎯 Exploit Status
Requires authentication for CLI exploitation or network access for HTTP exploitation. Format string vulnerabilities typically require specific knowledge of memory layout.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiProxy: 7.2.6, 7.0.12, 2.0.14, 1.2.14, 1.1.7; FortiPAM: 1.1.1, 1.0.4; FortiOS: 7.4.1, 7.2.6, 7.0.14, 6.4.15, 6.2.16; FortiSwitchManager: 7.2.3, 7.0.3
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-23-137
Restart Required: Yes
Instructions:
1. Download appropriate firmware from Fortinet support portal. 2. Backup current configuration. 3. Upload firmware via web interface or CLI. 4. Reboot device after installation. 5. Verify successful upgrade.
🔧 Temporary Workarounds
Restrict CLI Access
allLimit CLI access to trusted administrators only using access control lists and strong authentication.
config system admin
edit <admin_user>
set trusthost1 <trusted_ip> <mask>
end
Network Segmentation
allPlace affected devices behind firewalls and restrict HTTP/HTTPS access to management interfaces.
🧯 If You Can't Patch
- Isolate affected devices from internet and critical internal networks
- Implement strict network access controls and monitor for suspicious CLI/HTTP activity
🔍 How to Verify
Check if Vulnerable:
Check current firmware version via CLI: 'get system status' or web interface: System > DashboardCheck Version:
get system status | grep VersionVerify Fix Applied:
Verify firmware version is at or above patched versions listed in vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unusual CLI command execution patterns
- HTTP requests with format string characters (%n, %s, %x)
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- Unusual outbound connections from Fortinet devices
- HTTP requests to management interfaces from unexpected sources
SIEM Query:
source="fortinet" AND (event_type="cli_command" OR http_method="POST") AND (message="*%*" OR user="unknown")