Forticlient is Fortinet’s basic VPN client which offers SSL VPN and IPSecVPN VPN connectivity. It also contains utility features which allow importing and exporting of VPN configurations and profiles.
Product: FortiClientWindows VPN client
Vulnerable Versions: 6.0.0 through 6.0.10
- 6.2.0 through 6.2.9
- 6.4.0 through 6.4.7
- 7.0.0 through 7.0.3
Patched Versions: 7.0.4 or above
- 6.4.8 or above
Confirmed Vulnerable Platforms: Windows
Introduction to CVE-2022-26113
This post is the third and final post regarding vulnerabilities discovered when looking at the security of some popular VPN clients. In the first two posts we covered local privilege escalation and arbitrary file writes in Pritunl VPN Client and AWS VPN Client. This post covers an arbitrary file write as SYSTEM in the Fortinet FortiClient VPN client.
This issue differs a little from the first two posts in that it does not abuse dangerous directives in an OpenVPN configuration file, but instead uses an over privileged file write in config backup functionality of FortiClient.
FortiClient VPN Overview
FortiClient VPN allows normal users of the VPN Client to backup their VPN configuration. The backup file is written by FortiClient’s scheduler service running as SYSTEM, which calls the FCConfig.exe on the specified backup file.
Since the file path used to perform the backup to is only validated in the UI of the application, it is possible to bypass any permission checks and force the service to write to an arbitrary location, even if the user does not have permission to do so.
The user can control partial contents of the configuration backup, which means at the very least they could write a .bat script to an administrator’s startup directory as one method of privilege escalation.
This vulnerability allows an arbitrary file to be written anywhere on the system while controlling part of the contents. This can lead to privilege escalation in a number of ways, the most common being writing a script to a privileged user’s startup folder and then waiting for that user to log onto the system.
FortiClient is an Electron app that interacts with various services running in the background. A normal user is able to start and interact with the Electron UI of FortiClient.
It is possible to start the FortiClient application with the Electron debugging enabled and attach that to a debugger with Chrome.
C:\Program Files\Fortinet\FortiClient\FortiClient.exe --remote-debugging-port=9222
Now, opening Chrome with chrome://inspect will allow you to attach to the FortiClient process.
Here you can see the backup feature within the UI of FortiClient. The UI allows you to choose a backup file and checks to make sure the current user has permission to write to that file before allowing it to be selected. The selection is then disabled from editing.
Now the file path for the backup file can be modified to anything.
Although FortiClient is not implemented in the same way as the other two VPN clients as a wrapper around OpenVPN, it was still possible to find a way to abuse the privileged services the client UI interacts with to write arbitrary files as SYSTEM.
We also want to thank the Fortinet team for working with us and getting this patched. As always, feel free to follow us on Twitter for more releases and blog posts: @RhinoSecurity, @daveysec
|2/23/2022||Issue reported to Fortinet|
|2/24/2022||Report acknowledged by Fortinet|
|4/13/2022||Rhino requests update on progress|
|4/14/2022||Fortinet updates issue has been fixed and assigned CVE, waiting on release|
|6/6/2022||Fortinet requests information for the advisory|
|6/8/2022||Fortinet informs Rhino the issue has been fixed and advisory published at https://www.fortiguard.com/psirt/FG-IR-22-044|