RADIUS authentication bypass in FortiProxy SSH component

1) Improper Authentication

EUVDB-ID: #VU69939

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-35843

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in FortiOS SSH login component when processing authentication requests if RADIUS authentication is used. A remote attacker can bypass authentication process and login into the device via sending specially crafted Access-Challenge response from the Radius server.

Mitigation

Install update from vendor's website.

Vulnerable software versions

FortiProxy: 2.0.0 - 7.0.6

External links

http://fortiguard.fortinet.com/psirt/FG-IR-22-255

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.