Eine unsachgemäße Beschränkung eines Pfades auf ein eingeschränktes Verzeichnis ('path traversal') Schwachstelle in Fortinet FortiManager 7.6.0 bis 7.6.1, FortiManager 7.4.1 bis 7.4.3, FortiManager Cloud 7.4.1

Successful exploitation of CVE-2024-48884 could allow an attacker to read arbitrary files on the FortiProxy appliance. This includes configuration files, potentially containing credentials, or other sensitive data. The impact is amplified if the FortiProxy is used as a reverse proxy for internal resources, as the attacker could potentially gain access to backend systems. While authentication is required, a compromised user account or a vulnerability in the authentication mechanism could be leveraged to exploit this path traversal. The blast radius extends to any data accessible by the FortiProxy process, potentially exposing internal network resources.

Organizations using FortiProxy in environments with weak authentication or exposed to external networks are particularly at risk. Shared hosting environments where multiple users share a single FortiProxy instance are also vulnerable, as a compromise of one user's account could potentially lead to access for other users. Legacy FortiProxy deployments running older, unpatched versions are especially susceptible.

• fortinet: Monitor FortiProxy logs for unusual file access attempts or requests containing directory traversal sequences (e.g., ../). • linux / server: Use lsof to identify processes accessing unexpected files or directories. Example:

lsof | grep /path/to/sensitive/file

• generic web: Use curl to test for path traversal vulnerabilities by appending directory traversal sequences to URLs. Example:

curl 'http://fortiproxy/../../../../etc/passwd'

• windows: Use PowerShell to check for suspicious processes or scheduled tasks that might be exploiting the vulnerability. Example:

Get-Process | Where-Object {$_.ProcessName -like '*suspicious*'}

1. 2025-01-14Disclosure

   disclosure

1. Reserviert2024-10-09
2. Veröffentlicht2025-01-14
3. Geändert2026-01-14
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-48884 is to upgrade to a patched version of FortiProxy. Fortinet has released updates to address this vulnerability. If immediate patching is not possible, consider implementing a Web Application Firewall (WAF) with rules to restrict access to sensitive files and directories. Specifically, configure the WAF to block requests containing path traversal sequences (e.g., ../). Additionally, review and strengthen authentication mechanisms to prevent unauthorized access to the FortiProxy appliance. After upgrade, confirm by attempting to access a restricted file via the web interface and verifying that access is denied.