Pierluigi Paganini
March 21, 2024
Security researchers at Horizon3 have released a for a critical vulnerability, tracked as (CVSS score 9.3), in Fortinet’s FortiClient Enterprise Management Server (EMS) software. The vulnerability is now actively exploited in attacks in the wild.
The vulnerability is a critical pervasive SQL injection issue that resides in the DAS component.
“An improper neutralization of special elements used in an SQL Command (‘SQL Injection’) vulnerability [CWE-89] in FortiClientEMS may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted requests.” the advisory.
Below are the affected versions and the release that addressed this flaw.
| Version | Affected | Solution |
|---|---|---|
| FortiClientEMS 7.2 | 7.2.0 through 7.2.2 | Upgrade to 7.2.3 or above |
| FortiClientEMS 7.0 | 7.0.1 through 7.0.10 | Upgrade to 7.0.11 or above |
Thiago Santana from the ForticlientEMS development team and UK NCSC reported the issue to the company.
The initial advisory reported that Fortinet was not aware of attacks in the wild exploiting this vulnerability.
However, the company has updated the advisory confirming that “this vulnerability is exploited in the wild.”
Horizon3’s Attack Team published a technical analysis of this vulnerability and the PoC exploit. The researchers demonstrated how to turn this SQL injection issue into remote code execution using the built-in functionality of Microsoft SQL Server.
The researchers explained that the database was not configured to run the xp_cmdshell command, however it was possible to do it using a few other SQL statements.
“The we are releasing only confirms the vulnerability by using a simple SQL injection without xp_cmdshell. To enable RCE, altering the POC is necessary.” reads the analysis published by Horizon3.
“There are various log files in C:\Program Files (x86)\Fortinet\FortiClientEMS\logs that can be examined for connections from unrecognized clients or other malicious activity. The MS SQL logs can also be examined for evidence of xp_cmdshell being utilized to obtain command execution.”
Follow me on Twitter: and and Mastodon
(SecurityAffairs – hacking, FortiClient)
