Fortinet FortiAuthenticator Vulnerable to Authorization Bypass Flaw
Fortinet has disclosed an incorrect authorization vulnerability in FortiAuthenticator, enabling unauthenticated attackers to access restricted functions.
Fortinet's Product Security Incident Response Team (PSIRT) has issued an advisory detailing an Incorrect Authorization vulnerability (CWE-863) within its FortiAuthenticator product. This security flaw, identified as FG-IR-26-253, could permit unauthenticated attackers to bypass critical authorization checks, thereby gaining unauthorized access to restricted functionalities.
The vulnerability stems from improper access control within the rest-api component of FortiAuthenticator. By exploiting this weakness, an attacker could potentially perform actions that are normally reserved for authenticated and authorized users, leading to a significant compromise of the system's integrity and confidentiality.
Fortinet has assigned a CVSSv3 score of 8.6 to this vulnerability, classifying it as 'High' severity. The score reflects the potential for remote exploitation without requiring any privileges or user interaction, coupled with the ability to impact confidentiality, integrity, and availability.
A wide range of FortiAuthenticator versions are affected by this vulnerability, spanning from version 6.6.0 up to 8.0.3. This broad impact underscores the importance for organizations utilizing these versions to take immediate action to secure their deployments.
While the advisory does not explicitly state whether this vulnerability is being actively exploited in the wild, the high CVSS score and the nature of authorization bypass flaws suggest a significant risk. Organizations are strongly advised to consult Fortinet's official advisories for the latest information and recommended remediation steps.
Fortinet has provided a list of affected versions and is expected to release patches or mitigation guidance. Users are urged to update their FortiAuthenticator instances to the latest secure versions as soon as they become available to prevent potential exploitation.
This disclosure highlights the ongoing challenges in securing identity and access management solutions, where authorization flaws can have far-reaching consequences for an organization's security posture.
The latest advisory from Fortinet clarifies that the vulnerability in FortiAuthenticator is specifically a 'Use of Hard-coded Password' (CWE-259), with a CVSSv3 score of 9.0. While the previous advisory mentioned an 'incorrect authorization' flaw, this new information details the underlying mechanism and severity, noting that the bypass occurs under specific, externally uncontrollable conditions.