FortiOS multiple pre-auth XSS vulnerabilities on SSL VPN

Summary

Failure to sanitize the error or message handling parameters in the SSL VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) attack.

Affected Products

FortiOS 6.0.0 to 6.0.4
FortiOS 5.6.0 to 5.6.7
FortiOS 5.4.0 to 5.4.12
FortiOS 5.2 branch and below

Solutions

Upgrade to FortiOS 5.4.13, 5.6.8, 6.0.5 or 6.2.0 and above. Workarounds: For workaround on the unfixed versions, if the SSL-VPN web portal feature is enabled, disable the SSL-VPN web portal service by applying the following CLI commands: For FortiOS 5.0 and below branches: config vpn ssl settings set sslvpn-enable disable end For FortiOS 5.2 and above branches: config vpn ssl settings unset source-interface end Revision History: 05-24-2019 Initial Version 11-26-2019 New fix on 5.4.13 released.

Acknowledgement

Fortinet is pleased to thank Meh Chang and Orange Tsai from DEVCORE Security Research Team for reporting this vulnerability under responsible disclosure.