FortiNAC - Stored XSS triggering RCE via license key forgery

Summary

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses.

Affected Products

At least
FortiNAC version 9.4.0 through 9.4.2
FortiNAC 9.2 all versions
FortiNAC 9.1 all versions
FortiNAC 8.8 all versions
FortiNAC 8.7 all versions
FortiNAC 8.6 all versions are not affected
FortiNAC 8.5 all versions are not affected
FortiNAC version 7.2.0

Solutions

Please upgrade to FortiNAC-F version 7.2.1 or above
Please upgrade to FortiNAC version 9.4.3 or above

Acknowledgement

Fortinet is pleased to thank Ilya "E Liu Ha" Polyakov, Angara Security for bringing this issue to our attention under responsible disclosure.

Timeline

2023-05-03: Initial publication