Fortinet has released a patch to address a critical security vulnerability affecting FortiClientLinux that could be exploited to achieve arbitrary code execution.
This vulnerability is numbered CVE-2023-45590 and has a CVSS score of 9.4 out of 10.
“Code Generation Improper Control (“Code Injection”) Vulnerability [CWE-94] Fortinet stated in the announcement that “FortinetLinux” in FortinetLinux could allow an unauthenticated attacker to execute arbitrary code by tricking FortiClientLinux users into accessing a malicious website.
The flaw, described as a situation where remote code execution occurs due to a “dangerous Nodejs configuration”, affects the following versions –
- FortiClientLinux versions 7.0.3 to 7.0.4 and 7.0.6 to 7.0.10 (upgrade to 7.0.11 or later)
- FortiClientLinux version 7.2.0 (upgrade to 7.2.1 or later)
Security researcher CataLpa from Dbappsecurity is credited with discovering and reporting the vulnerability.
Fortinet’s April 2024 security patch also resolves an issue in the FortiClientMac installer that could also lead to code execution (CVE-2023-45588 and CVE-2024-31492, CVSS score: 7.8).
Also resolved is a FortiOS and FortiProxy bug that could leak administrator cookies under certain circumstances (CVE-2023-41677, CVSS score: 7.5).
While there is no evidence that any of the flaws are widely exploited, users are advised to keep their systems up to date to mitigate potential threats.
