CVE-2021-22128 : Security Advisory and Response

This article provides detailed information about CVE-2021-22128, an improper access control vulnerability in Fortinet FortiProxy.

Understanding CVE-2021-22128

CVE-2021-22128 is an improper access control vulnerability in FortiProxy SSL VPN portal versions 2.0.0, 1.2.9, and below. This vulnerability may allow a remote attacker to access internal services on the FortiProxy appliance.

What is CVE-2021-22128?

CVE-2021-22128 is an improper access control vulnerability that enables an authenticated, remote attacker to access internal services like the ZebOS Shell via the Quick Connection functionality on the FortiProxy appliance.

The Impact of CVE-2021-22128

The impact of this vulnerability is rated as HIGH, with a base severity score of 7.1 (CVSS v3.1). It has a significant availability impact, potentially allowing unauthorized access to critical services.

Technical Details of CVE-2021-22128

This section covers the technical aspects of CVE-2021-22128 including the vulnerability description, affected systems, and the exploitation mechanism.

Vulnerability Description

The vulnerability lies in the improper access control mechanism of FortiProxy SSL VPN portal versions 2.0.0, 1.2.9, and below, which could be exploited by an authenticated, remote attacker.

Affected Systems and Versions

Fortinet FortiProxy versions 2.0.0, 1.2.9, and below are affected by this vulnerability.

Exploitation Mechanism

The vulnerability can be exploited by an authenticated, remote attacker using the Quick Connection functionality to gain unauthorized access to internal services on the FortiProxy appliance.

Mitigation and Prevention

To mitigate the risks associated with CVE-2021-22128, immediate steps should be taken to secure the FortiProxy appliance and prevent unauthorized access.

Immediate Steps to Take

Apply the latest security patches provided by Fortinet to address the vulnerability.
Restrict access to the FortiProxy appliance to authorized users only.

Long-Term Security Practices

Regularly update the FortiProxy software to ensure the latest security fixes are in place.
Conduct security audits and vulnerability scans periodically to identify and address security weaknesses.

Patching and Updates

Keep the FortiProxy appliance up to date with security patches released by Fortinet to protect against known vulnerabilities and maintain a secure environment.