CVE-2021-22123 – Fortinet / FortiWeb – OS command injection
CVE-2021-22123 is an OS command injection vulnerability impacting multiple versions of Fortinet FortiWeb’s management interface. A proof of concept (PoC) was observed in open source. A successful exploitation of this vulnerability would allow an authenticated attacker to remotely execute arbitrary commands on the system via the SAML server configuration page.
Summary:
CVE-2021-22123 is an OS command injection vulnerability impacting multiple versions of Fortinet FortiWeb’s management interface. A proof of concept (PoC) was observed in open source. A successful exploitation of this vulnerability would allow an authenticated attacker to remotely execute arbitrary commands on the system via the SAML server configuration page.
PoC Links(if available):
Rapid7: Fortinet FortiWeb OS Command Injection –
https://www.rapid7.com/blog/post/2021/08/17/fortinet-fortiweb-os-command-injection/
Known Counter Measures:
Fortinet addressed the vulnerability in FortiWeb versions 6.3.8 or above.
Links to patches(if available)
https://www.fortiguard.com/psirt/FG-IR-20-120
