Authenticated user null pointer dereference in SSL-VPN

Summary

A NULL pointer dereference vulnerability [CWE-476] in SSL-VPN may allow an authenticated remote attacker to trigger a crash of the SSL-VPN service via crafted requests.

Affected Products

FortiProxy version 7.2.0 through 7.2.3
FortiProxy version 7.0.0 through 7.0.9
FortiProxy 2.0 all versions are not affected
FortiProxy 1.2 all versions are not affected
FortiProxy 1.1 all versions are not affected
FortiOS 7.4 all versions are not affected
FortiOS version 7.2.0 through 7.2.4
FortiOS version 7.0.0 through 7.0.10
FortiOS version 6.4.0 through 6.4.12
FortiOS 6.2 all versions are not affected

Solutions

Please upgrade to FortiOS version 7.4.0 or above
Please upgrade to FortiOS version 7.2.5 or above
Please upgrade to FortiOS version 7.0.11 or above
Please upgrade to FortiOS version 6.4.13 or above
Please upgrade to FortiProxy version 7.2.4 or above
Please upgrade to FortiProxy version 7.0.10 or above

Acknowledgement

Fortinet thanks to Aliz Hammond of watchTowr and NimdaKey of 360 Noah Lab for reporting this vulnerability.

Timeline

2023-06-16: Initial publication