Fortigate remote code execution vulnerability

4:10pm, 13 July 2023

TLP Rating: Clear

A vulnerability has been discovered that affects FortiGate devices running FortiOS and FortiProxy.

This stack-based buffer overflow vulnerability allows for an attacker to run unauthorised code or commands remotely on the affected system.

The vulnerability is tracked as CVE-2023-33308.

What to look for

All FortiGate devices running the following FortiOS and FortiProxy versions.

Upgrade your devices running FortiOS or FortiProxy to the latest version as soon as possible.

Please upgrade to:

Disable HTTP/2 support on SSL inspection profiles used by proxy policies or firewall policies with proxy mode.

Example with custom-deep-inspection profile:

config firewall ssl-ssh-profile

edit "custom-deep-inspection"

set supported-alpn http1-1

end

For more information see the Fortigate page on HTTP/2 support in proxy mode.

Official information released by Fortinet will be available here:

If you require more information or further support, submit a report on our website or contact us on 0800 CERTNZ.