OS command injection due to direct input interpolation in API controllers

Summary

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute arbitrary code or commands via crafted HTTP requests to ApplicationDelivery, JsonProtection and WebProtection controllers.

Affected Products

FortiWeb version 5.9.0 through 5.9.1
FortiWeb version 6.0.0 through 6.0.7
FortiWeb version 6.1.0 through 6.1.2
FortiWeb version 6.2.0 through 6.2.6
FortiWeb version 6.3.0 through 6.3.16
FortiWeb version 6.4.0 through 6.4.1

Solutions

Upgrade to FortiWeb version 7.0.0 or above
Upgrade to FortiWeb version 6.4.2 or above
Upgrade to FortiWeb version 6.3.17 or above
Upgrade to FortiWeb version 6.2.7 or above
Upgrade to FortiWeb version 6.1.3 or above
Upgrade to FortiWeb version 6.0.8 or above
Upgrade to FortiWeb version 5.9.2 or above

Acknowledgement

Internally discovered and reported by Mattia Fecit of Fortinet Product Security team.

Timeline

2022-02-01: Initial publication