PSIRTLack of configuration file validation
Summary
An external control of file name or path vulnerability [CWE-73] in FortiClientMac's installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process.
| Version | Affected | Solution |
|---|---|---|
| FortiClientMac 7.2 | 7.2.0 through 7.2.3 | Upgrade to 7.2.4 or above |
| FortiClientMac 7.0 | 7.0.6 through 7.0.10 | Upgrade to 7.0.11 or above |
Acknowledgement
Fortinet is pleased to thank Tomas Kabrt for reporting this vulnerability under responsible disclosure.Timeline
2024-04-09: Initial publication