{"id":20095,"date":"2023-09-19T23:03:29","date_gmt":"2023-09-19T15:03:29","guid":{"rendered":"https:\/\/blog.pmail.idv.tw\/?p=20095"},"modified":"2023-09-19T23:07:34","modified_gmt":"2023-09-19T15:07:34","slug":"%e8%b3%87%e5%ae%89%e9%80%9a%e5%a0%b1-fg-ir-23-106-fortios-fortiproxy-stored-xss-in-guest-management-page","status":"publish","type":"post","link":"https:\/\/blog.pmail.idv.tw\/?p=20095","title":{"rendered":"[\u8cc7\u5b89\u901a\u5831] FG-IR-23-106 FortiOS &amp; FortiProxy &#8211; Stored XSS in guest management page"},"content":{"rendered":"<p>\u53c8\u6709\u8cc7\u5b89\u6f0f\u6d1e\u63ed\u767c\uff0c\u6709\u4f7f\u7528fortinet \u7684\u670b\u53cb\u8a18\u5f97\u62bd\u7a7a\u66f4\u65b0\u56c9<\/p>\n<p><!--more--><\/p>\n<p>\u6458\u8981\uff1aFortiOS and FortiProxy GUI\u4e2d\u7db2\u9801\u5b58\u5728Cross-site Scripting(XSS)\u6f0f\u6d1e\uff0c\u7d93\u8eab\u5206\u9a57\u8b49\u7684\u653b\u64ca\u8005\u900f\u904e\u50b3\u9001\u7279\u88fd\u7684\u8a2a\u5ba2\u7ba1\u7406\u8a2d\u7f6e\uff0c\u4f7f\u5176\u89f8\u767c\u60e1\u610fJavaScript \u4ee3\u78bc\u57f7\u884c\u3002<br \/>\u25ba CVE \u7de8\u865f\uff1aCVE-2023-29183<br \/>\u25ba \u53d7\u5f71\u97ff\u5ee0\u5546\uff1aFortinet<br \/>\u25ba \u53d7\u5f71\u97ff\u7522\u54c1\uff1a<br \/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \u25ba FortiProxy 7.2.0 \u81f3 7.2.4\u7248\u672c\u53d7\u5f71\u97ff\uff0c\u5347\u7d1a\u81f37.2.5\u4ee5\u4e0a\u7248\u672c\u4fee\u6b63<br \/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \u25ba FortiProxy 7.0.0 \u81f3 7.0.10\u7248\u672c\u53d7\u5f71\u97ff\uff0c\u5347\u7d1a\u81f37.0.11\u4ee5\u4e0a\u7248\u672c\u4fee\u6b63<br \/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \u25ba FortiOS \u5347\u7d1a\u81f37.4.0\u4ee5\u4e0a\u7248\u672c\u4fee\u6b63<br \/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \u25ba FortiOS 7.2.x: 7.2.0 \u81f3 7.2.4 \u7248\u672c\u53d7\u5f71\u97ff\uff0c\u5347\u7d1a\u81f37.2.5\u4ee5\u4e0a\u7248\u672c\u4fee\u6b63<br \/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \u25ba FortiOS 7.0.x: 7.0.0 \u81f3 7.0.11 \u7248\u672c\u53d7\u5f71\u97ff\uff0c\u5347\u7d1a\u81f37.0.12\u4ee5\u4e0a\u7248\u672c\u4fee\u6b63<br \/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \u25ba FortiOS 6.4.x: 6.4.0 \u81f3 6.4.12 \u7248\u672c\u53d7\u5f71\u97ff\uff0c\u5347\u7d1a\u81f36.4.13\u4ee5\u4e0a\u7248\u672c\u4fee\u6b63<br \/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \u25ba FortiOS 6.2.x: 6.2.0 \u81f3 6.2.14 \u7248\u672c\u53d7\u5f71\u97ff\uff0c\u5347\u7d1a\u81f36.2.15\u4ee5\u4e0a\u7248\u672c\u4fee\u6b63<br \/>\u25ba \u4fee\u88dc\u8aaa\u660e\uff1aFortinet\u65bc 2023\/09\/01 \u767c\u5e03\u6b64\u6f0f\u6d1e\uff08\u8a73\u7d30\u8acb\u53c3\u8003\uff1a<a href=\"https:\/\/www.fortiguard.com\/psirt\/FG-IR-23-106\">https:\/\/www.fortiguard.com\/psirt\/FG-IR-23-106<\/a>\uff09<\/p>\n<p>&nbsp;<\/p>\n<p><strong>\u53c3\u8003\u8cc7\u6599<\/strong><\/p>\n<p>CVE-2023-29183<br \/><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-29183\">https:\/\/www.cve.org\/CVERecord?id=CVE-2023-29183<\/a><\/p>\n<p><strong>FortiOS &#8211; Buffer overflow in execute extender command<\/strong> <\/p>\n<p>\u25ba \u6458\u8981\uff1aFortiOS \u5b58\u5728\u5806\u758a\u578b\u7de9\u885d\u5340\u6ea2\u4f4d\u6f0f\u6d1e\uff08CWE-121: Stack-based Buffer Overflow\uff09\uff0c\u7d93\u8eab\u5206\u9a57\u8b49\u7684\u653b\u64ca\u8005\u900f\u904e\u7279\u88fd CLI \u7e5e\u904e FortiOS \u9632\u8b77\u6a5f\u5236\u4ee5\u57f7\u884c\u4efb\u610f\u7a0b\u5f0f\u78bc\u3002<br \/>\u25ba CVE \u7de8\u865f\uff1aCVE-2023-29182<br \/>\u25ba \u53d7\u5f71\u97ff\u5ee0\u5546\uff1aFortinet<br \/>\u25ba \u53d7\u5f71\u97ff\u7522\u54c1\uff1a<br \/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \u25ba FortiOS 7.0.0 &#8211; 7.0.3\uff08\u542b\uff09\u4ee5\u524d\u7248\u672c<br \/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \u25ba FortiOS 6.4 \u6240\u6709\u7248\u672c<br \/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \u25ba FortiOS 6.2 \u6240\u6709\u7248\u672c<br \/>\u25ba \u4fee\u88dc\u8aaa\u660e\uff1aFortinet \u65bc 2023\/08\/17 \u66f4\u65b0\u6b64\u6f0f\u6d1e\uff08\u8a73\u7d30\u8acb\u53c3\u8003\uff1a<a href=\"http:\/\/link.ap.logicalis.com\/ls\/click?upn=N3XbOgWhg-2F-2F8PZCumhPQ20ytJ1zYweVpYjbCjJ7QkDyHaownL3FVjxsF9TcdSY9Znc2L2Qh33sao4uBlVxlxQWmk3qwb2kJo0WkoIHT3VnqJGf9TqkEvpYiwXo6a5eB7timVDiAsIO8-2F0CbgP0S7UAcrMPlkbausalDPT-2F-2BZASTOASFiUI0tHH-2BJglo6RefL4REHbgwVREGsuEH0Eg2tBrsA15tx2U-2FLZIG-2BCyGLVneGDLslxZJfmpvcluz9itZWex6Y_MJfGDTUoXuY6WZxS0H5xfZ6O2-2FqVONUDsaFREx8oqWZ4dXSAqkS4DouM7CcoBEyH0OeZGsZ0uyOy6b5mRA7FQMNADExZCidZrnjD3HUhgfIrlKLUMppqnBDXG4qWUzwo21bV2sX3RW1DCGpcO489EE5AIsKSNuE5y2TfM5KJY1g4Fba2vcC6TJ6h-2FCe127swwv6isnAs6u9e3KaQ2umMg6yKDnd5ZFNaOmmpvFPUJ-2BdEgKv4RtBeTSvN2BWcVYOrkIw8nO02cH19-2BCgt65Ndv1KIcTX56H5kkPcymkc-2BoXg5LHacj-2BiKieSO-2FHP44K0danY47BVl4y4HQo6zsKbJgS0oef23Ldu1dd1CqhNDVWUGXm1DY6P4YTSPFpG7KKlaNKSHer4W3cbVUwRbEDxVYfMnyDUB-2FkFrcjPoGs08dEyLZh2rk73muaQyHdfP6gsl2PNPtG9LD-2F7n8sD5I5I3cw-3D-3D\">https:\/\/www.fortiguard.com\/psirt\/FG-IR-23-149<\/a>\uff09 <\/p>\n<p><strong>\u53c3\u8003\u8cc7\u6599<\/strong> <\/p>\n<p>\u25ba&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CVE-2023-29182<br \/><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-29182\">https:\/\/www.cve.org\/CVERecord?id=CVE-2023-29182<\/a><\/p>\n<div class=\"21cd169d3c0f71e95b84db320302cb4a\" data-index=\"1\" style=\"float: right; margin:10px 0 10px 10px;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-8711325745898650\"\r\n     crossorigin=\"anonymous\"><\/script>\n<\/div>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>\u53c8\u6709\u8cc7\u5b89\u6f0f\u6d1e\u63ed\u767c\uff0c\u6709\u4f7f\u7528fortinet \u7684\u670b\u53cb\u8a18\u5f97\u62bd\u7a7a\u66f4\u65b0\u56c9<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[194,183],"tags":[],"class_list":["post-20095","post","type-post","status-publish","format-standard","hentry","category-194","category-183"],"_links":{"self":[{"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/posts\/20095","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=20095"}],"version-history":[{"count":4,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/posts\/20095\/revisions"}],"predecessor-version":[{"id":20099,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/posts\/20095\/revisions\/20099"}],"wp:attachment":[{"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}