CVE-2021-41024: 
FortiOS vulnerability analysis and mitigation

A relative path traversal vulnerability (CVE-2021-41024) was discovered in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy version 7.0.0. The vulnerability was disclosed on December 7, 2021, and received a High severity rating with a CVSS v3.1 score of 7.5 (Fortinet Advisory, NVD).

The vulnerability is classified as a path traversal issue [CWE-22] that allows an unauthenticated, unauthorized attacker to inject path traversal character sequences via the GET request of the login page. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, no privileges required, and no user interaction needed (NVD).

If exploited, this vulnerability allows attackers to disclose sensitive information from the server. The impact is primarily focused on confidentiality, with high potential for information disclosure, while integrity and availability are not affected (Fortinet Advisory).

Fortinet has released patches to address this vulnerability. Users should upgrade FortiGate to version 7.0.2 or above, and FortiProxy to version 7.0.1 or above. FortiGate versions 6.2.x and 6.4.x are not impacted by this vulnerability (Fortinet Advisory).

Fortinet acknowledged Mohammed Eldeeb from Spark Engineering Consultants for reporting this vulnerability under responsible disclosure (Fortinet Advisory).