Fortinet Remote Code Execution Vulnerability (CVE-2023-33308)

A critical Remote Code Execution vulnerability (CVE-2023-33308) was discovered in FortiOS and FortiProxy products recently which may allow a remote attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection.

Fortinet has released the patches to remediate the vulnerability and strongly recommends customers to apply the update IMMEDIATELY.

Vulnerabilities

• Remote Code Execution Vulnerability (CVE-2023-33308)

Severity Level

• Critical

Affected Systems

• FortiOS version 7.2.0 through 7.2.3
• FortiOS version 7.0.0 through 7.0.10
• FortiProxy version 7.2.0 through 7.2.2
• FortiProxy version 7.0.0 through 7.0.9

Remediation

• Please apply the latest update patches in your department devices immediately.
• Furthermore, the following workaround is suggested as a temporary solution:
  • Disable HTTP/2 support on SSL inspection profiles used by proxy policies or firewall policies with proxy mode.
    Example with custom-deep-inspection profile:
    config firewall ssl-ssh-profile
       edit “custom-deep-inspection”
          set supported-alpn http1-1
       next
    end
  • Reference:  https://docs.fortinet.com/document/fortigate/7.0.0/new-features/710924/http-2-support-in-proxy-mode-ssl-inspection

Reference

• https://www.fortiguard.com/psirt/FG-IR-23-183
• https://www.hkcert.org/security-bulletin/fortinet-products-multiple-vulnerabilities_20230712

Enquiry

• For enquiries, please contact infosec@cuhk.edu.hk. Thanks a lot.

Published on: 20 Jul 2023