Stored XSS in Fortinet FortiWeb

1) Stored cross-site scripting (XSS)

EUVDB-ID: #VU9404

Risk: Low

CVSSv3.1: 5.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-7736

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in Fortinet FortiWeb webUI Certificate View page. A remote authenticated attacker can execute arbitrary HTML and script code in victim's browser via special specially crafted malicious certificate import.

Mitigation

Update to version 5.8.1 or 5.7.2.

Vulnerable software versions

Fortinet FortiWeb: 5.7.0 - 5.8.0

External links

http://fortiguard.com/psirt/FG-IR-17-131

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.