Vulnerability-Lookup

CNVD-2022-47985

Vulnerability from cnvd - Published: 2022-06-28

Title

Fortinet多款产品操作系统命令注入漏洞

Description

Fortinet FortiManager等都是美国飞塔（Fortinet）公司的产品。Fortinet FortiManager是一套集中化网络安全管理平台。Fortinet FortiAnalyzer是一套集中式网络安全报告解决方案。Fortinet FortiPortal是FortiGate、FortiWiFi和FortiAP产品线的高级、功能丰富的托管安全分析和管理支持工具，可作为虚拟机供MSP使用。 Fortinet多款产品存在操作系统命令注入漏洞，本地经过身份验证的攻击者可利用该漏洞通过特制的CLI命令参数以root身份执行任意shell命令。

Severity

高

Patch Name

Fortinet多款产品操作系统命令注入漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.fortiguard.com/psirt/FG-IR-21-037

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-26104

Impacted products

Name
['Fortinet FortiAnalyzer <=6.4.5', 'Fortinet FortiAnalyzer <=6.2.7', 'Fortinet FortiAnalyzer 6.0.', 'Fortinet FortiManager <=6.4.5', 'Fortinet FortiManager <=6.2.7', 'Fortinet FortiManager 6.0.', 'Fortinet FortiManager 6.2.', 'Fortinet FortiManager 5.6.', 'Fortinet FortiAnalyzer 6.2.', 'Fortinet FortiAnalyzer 5.6.', 'Fortinet FortiPortal <=5.2.5', 'Fortinet FortiPortal <=5.3.5', 'Fortinet FortiPortal <=6.0.4']

Name

['Fortinet FortiAnalyzer <=6.4.5', 'Fortinet FortiAnalyzer <=6.2.7', 'Fortinet FortiAnalyzer 6.0.*', 'Fortinet FortiManager <=6.4.5', 'Fortinet FortiManager <=6.2.7', 'Fortinet FortiManager 6.0.*', 'Fortinet FortiManager 6.2.*', 'Fortinet FortiManager 5.6.*', 'Fortinet FortiAnalyzer 6.2.*', 'Fortinet FortiAnalyzer 5.6.*', 'Fortinet FortiPortal <=5.2.5', 'Fortinet FortiPortal <=5.3.5', 'Fortinet FortiPortal <=6.0.4']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-26104"
    }
  },
  "description": "Fortinet FortiManager\u7b49\u90fd\u662f\u7f8e\u56fd\u98de\u5854\uff08Fortinet\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Fortinet FortiManager\u662f\u4e00\u5957\u96c6\u4e2d\u5316\u7f51\u7edc\u5b89\u5168\u7ba1\u7406\u5e73\u53f0\u3002Fortinet FortiAnalyzer\u662f\u4e00\u5957\u96c6\u4e2d\u5f0f\u7f51\u7edc\u5b89\u5168\u62a5\u544a\u89e3\u51b3\u65b9\u6848\u3002Fortinet FortiPortal\u662fFortiGate\u3001FortiWiFi\u548cFortiAP\u4ea7\u54c1\u7ebf\u7684\u9ad8\u7ea7\u3001\u529f\u80fd\u4e30\u5bcc\u7684\u6258\u7ba1\u5b89\u5168\u5206\u6790\u548c\u7ba1\u7406\u652f\u6301\u5de5\u5177\uff0c\u53ef\u4f5c\u4e3a\u865a\u62df\u673a\u4f9bMSP\u4f7f\u7528\u3002\n\nFortinet\u591a\u6b3e\u4ea7\u54c1\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u672c\u5730\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7279\u5236\u7684CLI\u547d\u4ee4\u53c2\u6570\u4ee5root\u8eab\u4efd\u6267\u884c\u4efb\u610fshell\u547d\u4ee4\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.fortiguard.com/psirt/FG-IR-21-037",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-47985",
  "openTime": "2022-06-28",
  "patchDescription": "Fortinet FortiManager\u7b49\u90fd\u662f\u7f8e\u56fd\u98de\u5854\uff08Fortinet\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Fortinet FortiManager\u662f\u4e00\u5957\u96c6\u4e2d\u5316\u7f51\u7edc\u5b89\u5168\u7ba1\u7406\u5e73\u53f0\u3002Fortinet FortiAnalyzer\u662f\u4e00\u5957\u96c6\u4e2d\u5f0f\u7f51\u7edc\u5b89\u5168\u62a5\u544a\u89e3\u51b3\u65b9\u6848\u3002Fortinet FortiPortal\u662fFortiGate\u3001FortiWiFi\u548cFortiAP\u4ea7\u54c1\u7ebf\u7684\u9ad8\u7ea7\u3001\u529f\u80fd\u4e30\u5bcc\u7684\u6258\u7ba1\u5b89\u5168\u5206\u6790\u548c\u7ba1\u7406\u652f\u6301\u5de5\u5177\uff0c\u53ef\u4f5c\u4e3a\u865a\u62df\u673a\u4f9bMSP\u4f7f\u7528\u3002\r\n\r\nFortinet\u591a\u6b3e\u4ea7\u54c1\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u672c\u5730\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7279\u5236\u7684CLI\u547d\u4ee4\u53c2\u6570\u4ee5root\u8eab\u4efd\u6267\u884c\u4efb\u610fshell\u547d\u4ee4\u3002 \u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Fortinet\u591a\u6b3e\u4ea7\u54c1\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Fortinet FortiAnalyzer \u003c=6.4.5",
      "Fortinet FortiAnalyzer \u003c=6.2.7",
      "Fortinet FortiAnalyzer 6.0.*",
      "Fortinet FortiManager \u003c=6.4.5",
      "Fortinet FortiManager \u003c=6.2.7",
      "Fortinet FortiManager 6.0.*",
      "Fortinet FortiManager 6.2.*",
      "Fortinet FortiManager 5.6.*",
      "Fortinet FortiAnalyzer 6.2.*",
      "Fortinet FortiAnalyzer 5.6.*",
      "Fortinet FortiPortal \u003c=5.2.5",
      "Fortinet FortiPortal \u003c=5.3.5",
      "Fortinet FortiPortal \u003c=6.0.4"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-26104",
  "serverity": "\u9ad8",
  "submitTime": "2022-04-07",
  "title": "Fortinet\u591a\u6b3e\u4ea7\u54c1\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2021-26104 (GCVE-0-2021-26104)

Vulnerability from cvelistv5 – Published: 2022-04-06 16:00 – Updated: 2024-10-25 13:33

Summary

Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-23 14:12 UTC

CWE

Execute unauthorized code or commands

Assigner

fortinet mitre root

References

2 references

URL	Tags
https://fortiguard.com/advisory/FG-IR-21-037	x_refsource_CONFIRM
https://github.com/orangecertcc/security-research…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Fortinet	Fortinet FortiManager, FortiAnalyzer, FortiPortal	Affected: FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:19:19.450Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://fortiguard.com/advisory/FG-IR-21-037"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-f73m-fvj3-m2pm"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-26104",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-23T14:12:42.570667Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-25T13:33:03.773Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Fortinet FortiManager, FortiAnalyzer, FortiPortal",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitCodeMaturity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "UNAVAILABLE",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Execute unauthorized code or commands",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-22T19:31:43.000Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://fortiguard.com/advisory/FG-IR-21-037"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-f73m-fvj3-m2pm"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@fortinet.com",
          "ID": "CVE-2021-26104",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Fortinet FortiManager, FortiAnalyzer, FortiPortal",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Fortinet"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "userInteraction": "None",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Execute unauthorized code or commands"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://fortiguard.com/advisory/FG-IR-21-037",
              "refsource": "CONFIRM",
              "url": "https://fortiguard.com/advisory/FG-IR-21-037"
            },
            {
              "name": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-f73m-fvj3-m2pm",
              "refsource": "MISC",
              "url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-f73m-fvj3-m2pm"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2021-26104",
    "datePublished": "2022-04-06T16:00:20.000Z",
    "dateReserved": "2021-01-25T00:00:00.000Z",
    "dateUpdated": "2024-10-25T13:33:03.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.