• Fortinet FortiNAC keyUpload.jsp Arbitrary File Write

    From Security Bot@2:250/1 to All on Sun Nov 3 12:22:00 2024


    Fortinet FortiNAC keyUpload.jsp Arbitrary File Write

    This Metasploit module uploads a payload to the /tmp directory in addition
    to a cron job to /etc/cron.d which executes the payload in the context of
    the root user. The core vulnerability is an arbitrary file write issue in /configWizard/keyUpload.jsp which is accessible remotely and without authentication. When you send the vulnerable endpoint a ZIP file, it will extract an attacker controlled file to a directory of the attackers choice
    on the target system. This issue is exploitable on FortiNAC versions 9.4
    prior to 9.4.1, FortiNAC versions 9.2 prior to 9.2.6, FortiNAC versions
    9.1 prior to 9.1.8, all versions of FortiNAC 8.8, all versions of FortiNAC
    8.7, all versions of FortiNAC 8.6, all versions of FortiNAC 8.5, and all versions of FortiNAC 8.3.

    https://packetstormsecurity.com/files/171351/fortinac_keyupload_file_write.rb.t xt

    Wed, 15 Mar 2023 14:45:21 GMT
    ________________________________
    --- The information is for inforamtional purposes only.
    * Origin: Read us with http://winpoint.org JID: rs@captflint.com