FortiSOAR Vulnerability Allows Unauthorized Access to Websocket Streams
Fortinet has disclosed a broken access control vulnerability in its FortiSOAR platform that could allow authenticated attackers with no permissions to access sensitive data and inject messages.
Fortinet's Product Security Incident Response Team (PSIRT) has identified and reported a significant security flaw within the FortiSOAR security orchestration, automation, and response platform. The vulnerability, classified under CWE-284 (Improper Access Control), carries a CVSSv3 score of 4.9, indicating a moderate severity.
This vulnerability specifically affects the platform's handling of websocket streams. Websockets are a communication protocol providing full-duplex communication channels over a single TCP connection, commonly used for real-time data transfer. In FortiSOAR, these streams are utilized for various operational functions, including real-time monitoring and alerts.
The core issue lies in the insufficient access control mechanisms governing these websocket streams. An attacker who has already gained authenticated access to the FortiSOAR system, even with the lowest possible privilege level (zero permissions), can exploit this flaw. By crafting specific websocket requests, the attacker can subscribe to these streams and their associated topics.
This subscription capability grants the attacker the potential to eavesdrop on real-time data flowing through the websocket channels. Depending on the nature of the data transmitted, this could include sensitive operational information, security alerts, or internal system communications that are not intended for general viewing.
Furthermore, the vulnerability extends beyond mere observation. The same crafted websocket requests can be used by the attacker to inject broadcast messages into the stream. This means an attacker could potentially send false or misleading information to other users or systems connected to the websocket stream, disrupting operations or causing confusion.
Fortinet has provided a security advisory detailing the vulnerability and its potential impact. While the CVSS score is moderate, the ability for an authenticated, low-privilege user to gain access to sensitive streams and inject messages highlights a critical gap in access control that could be leveraged in more sophisticated attacks.
Users of FortiSOAR are advised to consult the official Fortinet PSIRT advisory for specific version information and recommended mitigation steps. Prompt application of any available patches or workarounds is crucial to prevent potential exploitation of this access control weakness.