FortiADC - WAF XSS Injection Bypass

Summary

An improper handling of malformed request vulnerability [CWE-228] in FortiADC may allow a remote attacker without privileges to bypass some Web Application Firewall (WAF) protection such as the SQL Injection and XSS filters via a malformed HTTP request.

Version Affected Solution
FortiADC 7.1 Not affected Not Applicable
FortiADC 7.0 7.0.0 through 7.0.2 Upgrade to 7.0.3 or above
FortiADC 6.2 6.2.0 through 6.2.3 Upgrade to 6.2.4 or above
FortiADC 6.1 6.1 all versions Migrate to a fixed release
FortiADC 6.0 6.0 all versions Migrate to a fixed release
FortiADC 5.4 5.4 all versions Migrate to a fixed release
FortiADC 5.3 5.3 all versions Migrate to a fixed release
FortiADC 5.2 5.2 all versions Migrate to a fixed release
FortiADC 5.1 5.1 all versions Migrate to a fixed release
FortiADC 5.0 5.0 all versions Migrate to a fixed release

Acknowledgement

Fortinet is pleased to thank Almas Zhurtanov and Tom Tervoort from Secura for bringing this issue to our attention under responsible disclosure.