FortiWeb Vulnerabilities Exploited: Path Traversal and OS Command Injection

Two vulnerabilities in FortiWeb have been identified, both exploited in the wild. The first, a relative path traversal vulnerability (CWE-23), allows unauthenticated attackers to execute administrative commands via crafted HTTP or HTTPS requests. The second, an OS command injection vulnerability (CWE-78), enables authenticated attackers to execute unauthorized code through crafted HTTP requests or CLI commands. Both vulnerabilities affect FortiWeb systems but do not impact FortiAppSec Cloud. Fortinet recommends disabling HTTP/HTTPS for internet-facing interfaces as a temporary mitigation until upgrades can be performed. Customers are advised to review their configurations and logs for unauthorized changes. Immediate action is necessary to prevent exploitation.

Key Points: • Two critical vulnerabilities in FortiWeb are actively being exploited. • The first vulnerability allows unauthenticated command execution; the second affects authenticated users. • Fortinet recommends disabling HTTP/HTTPS access until systems are upgraded.