CVE-2017-14186

MEDIUMNuclei

FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2017-14186 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 23, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

FortiOS

Browse Fortinet, Inc. / FortiOS
CVE List5.6.0 to 5.6.2affected
5.4.0 to 5.4.6affected
5.2.0 to 5.2.12affected
5.0 and belowaffected

Nuclei templates

1
ProjectDiscoveryMEDIUMFortiGate FortiOS SSL VPN Web Portal - Cross-Site ScriptingCVSS 5.4

FortiGate FortiOS through SSL VPN Web Portal contains a cross-site scripting vulnerability. The login redir parameter is not sanitized, so an attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks such as a URL redirect. Affected versions are 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, and 5.4 and below.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, data theft, or defacement.

Remediation

Apply the latest security patches or firmware updates provided by Fortinet to mitigate this vulnerability.

WeaknessesCWE-79
Authorsjohnk3r
Template tagscve2017cvefortigatexssfortinetvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Shodan: port:10443 http.favicon.hash:945408572
Shodan: http.favicon.hash:945408572
Shodan: cpe:"cpe:2.3:o:fortinet:fortios"
Shodan: http.html:"/remote/login" "xxxxxxxx"
FOFA: body="/remote/login" "xxxxxxxx"
FOFA: icon_hash=945408572
https://www.fortiguard.com/psirt/FG-IR-17-242 https://fortiguard.com/advisory/FG-IR-17-242 https://web.archive.org/web/20210801135714/http://www.securitytracker.com/id/1039891 https://nvd.nist.gov/vuln/detail/CVE-2017-14186 http://www.securitytracker.com/id/1039891

Source: ProjectDiscovery

References

4