CVE-2023-41677: 
FortiOS vulnerability analysis and mitigation

An insufficiently protected credentials vulnerability (CWE-522) affects FortiOS and FortiProxy systems. The vulnerability, identified as CVE-2023-41677, was discovered internally by Fortinet's Product Security team and publicly disclosed on April 9, 2024. This security flaw potentially allows an attacker to obtain administrator cookies through specific conditions when an administrator is tricked into visiting a malicious website through SSL-VPN (Fortiguard PSIRT).

The vulnerability is classified with a CVSSv3 score of 7.5 (High severity) and is identified as an insufficiently protected credentials issue (CWE-522). The flaw specifically affects the SSL-VPN component of both FortiOS and FortiProxy systems, where administrator cookies can be compromised under specific conditions when interacting with malicious websites (Fortiguard PSIRT).

If successfully exploited, the vulnerability allows attackers to execute unauthorized code or commands by obtaining administrator cookies. This could potentially lead to unauthorized administrative access to affected FortiOS and FortiProxy systems (Fortiguard PSIRT).

The exploitation requires specific conditions where an administrator must be tricked into visiting a malicious attacker-controlled website while accessing the system through SSL-VPN. The attack vector requires social engineering to be successful (Fortiguard PSIRT).

Fortinet has released patches for affected versions. FortiOS users should upgrade to versions 7.4.2 or above (for 7.4 branch), 7.2.7 or above (for 7.2 branch), 7.0.13 or above (for 7.0 branch), 6.4.15 or above (for 6.4 branch), and 6.2.16 or above (for 6.2 branch). FortiProxy users should upgrade to versions 7.4.2 or above (for 7.4 branch), 7.2.8 or above (for 7.2 branch), and 7.0.14 or above (for 7.0 branch). Users of FortiProxy versions 2.0, 1.2, 1.1, and 1.0 should migrate to a fixed release (Fortiguard PSIRT).