New Vulnerabilities Disclosed in SonicWall and Fortinet Network Security Products
13.7.23  Vulnerebility  The Hacker News

SonicWall on Wednesday urged customers of Global Management System (GMS) firewall management and Analytics network reporting engine software to apply the latest fixes to secure against a set of 15 security flaws that could be exploited by a threat actor to circumvent authentication and access sensitive information.

Of the 15 shortcomings (tracked from CVE-2023-34123 through CVE-2023-34137), four are rated Critical, four are rated High, and seven are rated Medium in severity. The vulnerabilities were disclosed by NCC Group.

The flaws impact on-premise versions of GMS 9.3.2-SP1 and before and Analytics 2.5.0.4-R7 and before. Fixes are available in versions GMS 9.3.3 and Analytics 2.5.2.

"The suite of vulnerabilities allows an attacker to view data that they are not normally able to retrieve," SonicWall said. "This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application's content or behavior."

The list of critical flaws is as follows -

CVE-2023-34124 (CVSS score: 9.4) - Web Service Authentication Bypass
CVE-2023-34133 (CVSS score: 9.8) - Multiple Unauthenticated SQL Injection Issues and Security Filter Bypass
CVE-2023-34134 (CVSS score: 9.8) - Password Hash Read via Web Service
CVE-2023-34137 (CVSS score: 9.4) - Cloud App Security (CAS) Authentication Bypass
The disclosure comes as Fortinet revealed a critical flaw affecting FortiOS and FortiProxy (CVE-2023-33308, CVSS score: 9.8) that could enable an adversary to achieve remote code execution under certain circumstances. It said the issue was resolved in a previous release, without an advisory.

"A stack-based overflow vulnerability [CWE-124] in FortiOS and FortiProxy may allow a remote attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection," the company said in an advisory.
Impacted products include FortiOS versions 7.2.0 through 7.2.3 and 7.0.0 through 7.0.10 as well as FortiProxy versions 7.2.0 through 7.2.2 and 7.0.0 through 7.0.9. The versions that plug the security hole are listed below -

FortiOS version 7.4.0 or above
FortiOS version 7.2.4 or above
FortiOS version 7.0.11 or above
FortiProxy version 7.2.3 or above, and
FortiProxy version 7.0.10 or above
It's worth noting that the flaw does not impact all versions of FortiOS 6.0, FortiOS 6.2, and FortiOS 6.4, and FortiProxy 1.x and FortiProxy 2.x.

For customers who cannot apply the updates immediately, Fortinet is recommending that they disable HTTP/2 support on SSL inspection profiles used by proxy policies or firewall policies with proxy mode.