SB2025040913 - MitM attack in FortiWeb

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper restriction of communication channel to intended endpoints (CVE-ID: CVE-2024-26013)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to missing certificate name verification for FGFM connection. A remote non-authenticated attacker can intercept the FGFM authentication request between the management device and the managed device and impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager).

Successful exploitation of the vulnerability may allow an attacker to compromise the affected device.

2) Improper restriction of communication channel to intended endpoints (CVE-ID: CVE-2024-50565)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to missing certificate name verification for FGFM connection. A remote non-authenticated attacker can intercept the FGFM authentication request between the management device and the managed device and impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager).

Successful exploitation of the vulnerability may allow an attacker to compromise the affected device.

Remediation

Install update from vendor's website.

References

• https://www.fortiguard.com/psirt/FG-IR-24-046