Fortinet FortiMail Vulnerable to Privilege Escalation via Crafted Release Requests
Fortinet has disclosed an improper authentication vulnerability in FortiMail that allows unauthenticated attackers to escalate privileges and manipulate quarantined messages.
Fortinet's Product Security Incident Response Team (PSIRT) has issued an advisory detailing an improper authentication vulnerability, identified as CWE-287, within the FortiMail email security gateway. This critical flaw, tracked as FG-IR-26-212, could permit an unauthenticated attacker to gain elevated privileges on the affected system.
The vulnerability resides in the releasecontrol component of FortiMail. By sending specially crafted quarantine release requests, an attacker can exploit this weakness to bypass authentication mechanisms. Successful exploitation grants the attacker the ability to release or delete any quarantined messages, regardless of the intended recipient's mailbox. This could lead to the exfiltration of sensitive information or the disruption of email security policies.
The severity of this vulnerability is underscored by its CVSSv3 score of 8.2, classifying it as High. The attack vector is network-based, requiring no prior authentication or user interaction, making it a significant threat to organizations relying on FortiMail for email security. The potential impact includes unauthorized access to sensitive communications and the circumvention of security controls designed to protect against malicious content.
Fortinet has identified a broad range of affected versions, spanning from FortiMail 7.2.0 through 8.0.1. The company has released security updates to address this vulnerability. Users are strongly advised to update their FortiMail systems to the latest available versions to mitigate the risk of exploitation.
The vulnerability was discovered internally by Gwendal Guegniaud of the Fortinet Product Security team, utilizing an AI model named Claude Mythos. This internal discovery highlights the ongoing efforts within security vendors to proactively identify and address potential weaknesses in their products.
While the advisory does not explicitly mention active exploitation in the wild, the high CVSS score and the nature of the vulnerability suggest it could be an attractive target for threat actors. Organizations using vulnerable versions of FortiMail should prioritize patching and review their security configurations to ensure robust protection against unauthorized access and data manipulation.
This incident serves as a reminder of the importance of regular security patching and the potential risks associated with authentication bypass vulnerabilities, especially in critical infrastructure components like email security gateways. Maintaining up-to-date software and implementing defense-in-depth strategies are crucial for safeguarding against such threats.