Eine unsachgemäße Beschränkung eines Pfades auf ein eingeschränktes Verzeichnis ('path traversal') in Fortinet FortiManager, FortiAnalyzer 7.4.0 bis 7.4.3 und 7.2.0 bis 7.2.5 und 7.0.2 bis 7.0.12 und 6.2.1

The path traversal vulnerability allows an attacker to bypass access controls and read or write files outside of the intended directory. Successful exploitation could lead to arbitrary code execution on the affected system, granting the attacker significant control. This could involve gaining access to sensitive configuration data, user credentials, or even installing malware. The potential blast radius is substantial, as compromised FortiManager/FortiAnalyzer instances often manage and monitor network security devices, potentially enabling attackers to pivot to other systems within the network. Similar path traversal vulnerabilities have historically been exploited to gain system-level access.

Organizations heavily reliant on Fortinet FortiManager and FortiAnalyzer for network management and security are at significant risk. This includes managed service providers (MSPs) managing multiple client networks, and organizations with legacy Fortinet deployments running vulnerable versions. Shared hosting environments where multiple tenants share a FortiManager/FortiAnalyzer instance are particularly vulnerable.

• fortinet: Check FortiManager/FortiAnalyzer version.

# Check version via CLI
show system status

• fortinet: Monitor access logs for suspicious requests containing path traversal sequences (e.g., ../../).

# Example grep pattern for access logs
grep '../..' /var/log/fortimanager/www.log

• fortinet: Review firewall rules to ensure proper access restrictions to management interfaces. • generic web: Use curl to test for path traversal vulnerabilities.

curl 'http://<fortimanager_ip>/../../../../etc/passwd' #Example - adjust URL

1. 2025-01-14Disclosure

   disclosure

1. Reserviert2024-05-29
2. Veröffentlicht2025-01-14
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-36512 is to upgrade FortiManager and FortiAnalyzer to version 7.4.4 or later. If immediate upgrading is not possible, consider implementing temporary workarounds such as restricting network access to the management interfaces of FortiManager and FortiAnalyzer using a Web Application Firewall (WAF) or proxy server. Configure the WAF/proxy to block requests containing suspicious path traversal patterns (e.g., '../'). Regularly review firewall rules and access logs for any signs of attempted exploitation. After upgrading, verify the fix by attempting to access files outside the intended directory via HTTP/HTTPS requests; access should be denied.