copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2014.0668 - [Appliance] FortiWeb: Cross-site request forgery - Remote with user interaction

Date: 07 May 2014

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2014.0668
             FortiWeb Cross-Site Request Forgery Vulnerability
                                7 May 2014

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           FortiWeb
Publisher:         FortiGuard
Operating System:  Network Appliance
Impact/Access:     Cross-site Request Forgery -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2014-3115  

Original Bulletin: 
   http://www.fortiguard.com/advisory/FG-IR-14-013/

- --------------------------BEGIN INCLUDED TEXT--------------------

FortiWeb Cross-Site Request Forgery Vulnerability

Info
Risk
    3 Medium 
Date
    May 02 2014
Impact
    Authorization Bypass
CVE ID
    CVE-2014-3115
Fixed In Firmware
    FortiWeb 5.2.0

Multiple CSRF vulnerabilities exist in the FortiWeb web administration console 
due to lack of CSRF token protection. This could allow remote attackers to 
perform administrative actions under specific conditions.

Impact
A remote unauthenticated attacker may be able to trick a user into making an 
unintentional request to the web administration interface, via link or 
JavaScript hosted on a malicious web page. This forged request may be treated 
as authentic and result in unauthorized actions in the web administration 
interface. A successful attack would require the administrator to be logged in,
and attacker knowledge of the internal FortiWeb administration URL.

Affected Products
FortiWeb 5.1.x and lower.

Solutions
Upgrade to FortiWeb 5.2.0 or higher.

Acknowledgement
This vulnerability was separately reported by both William Costa and Enrique 
Nissim.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBU2mCSxLndAQH1ShLAQJG0hAAuiWSzwf+HWlPZoYT+jsdVHc49VVsUvWc
nFErK/rLZJ6siMfLuFJ+9DqWwfv44CAt5f1iCml8xmSB3m4Z4+3eNhZtiAhyrfP7
F1k20d5gDaq5b5PNpPTQGii7GDz9uTPTf68gi8qZyaDti/SUTaNH1PWCvD3lIIqL
axtZbNxWSIqi4lxP70ox3b5hJ7K6BATQEmfJKsnBqbkpxBhiEN4qV+fUFUBwNKjF
ED4JkCTnyIan5oggtY3V4vdG4b4X1TcKkcnU64qwtStsP8KUP92XNxTLNF+bhYro
If6c47ZNazUsB9dOTxHMtJ7r+RfgclHqlFlG2IpOqvgx/y+rvSminxx0uDu1V9/8
gy6yDAb5IRJc9vYzybws78eTsxr3nldSC4coCtox4MNe8UXlSeNMjhPyVAMvoWyk
3xZT3fIGJMtxbDh8hiQv/c+JZobF4Re6W991ianNSHLelVUigvC+dViK/FAVjfhI
aw3xmy0e5WTpZlRCza5dchrVlyiYYbguw/bQt0bRpd4SjK0WSsTS/ZLcolM/PSIe
oJMDLATV+nMKebynKZ8v7URjmgo7HS6YjzoMNiTQ4sW+b4eDrt9iucB48/bgigqT
IVrU62RfnzAzxPkkFQGJ2ip9KkO0KxT+njJlYwK5nBeEEL77WCihrJy8Rj9VEG1r
rssSAzIuja0=
=HJmu
-----END PGP SIGNATURE-----