CVE-2023-44253: 
Fortinet FortiManager vulnerability analysis and mitigation

An exposure of sensitive information vulnerability (CVE-2023-44253) was discovered in Fortinet FortiManager, FortiAnalyzer, and FortiAnalyzer-BigData products. The vulnerability was initially published on February 8, 2024, and affects multiple versions of these products. The issue allows an ADOM administrator to enumerate other ADOMs and device names through crafted HTTP or HTTPS requests (Fortinet Advisory).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) with a CVSS v3.1 base score of 4.7 (Medium severity). The issue occurs when websocket exchanges contain simple IDs that can be incrementally manipulated to leak information about other ADOMs through error messages. The vulnerability specifically affects FortiManager versions 7.4.0-7.4.1 and earlier versions, FortiAnalyzer versions 7.4.0-7.4.1 and earlier versions, and FortiAnalyzer-BigData versions before 7.2.5 (Fortinet Advisory, Orange Research).

The vulnerability can lead to customer name leakage since ADOM names typically contain customer information. This information disclosure could potentially be leveraged in other attacks. When exploited, the vulnerability allows unauthorized access to sensitive organizational information through error message enumeration (Orange Research).

Fortinet has released patches to address this vulnerability. Users should upgrade to the following versions: FortiManager 7.4.2 or above, FortiAnalyzer 7.4.2 or above, and FortiAnalyzer-BigData 7.2.6 or above. For older versions, users should migrate to a fixed release. The security researchers recommend that error messages should not contain detailed information about requested items (Fortinet Advisory).

The vulnerability was responsibly disclosed by Mickael Dorigny at Orange Cyberdefense, along with Frédéric Prevost, François-Xavier Picard, and Orange CERT-CC at Orange group. The disclosure and patching process was coordinated between the security researchers and Fortinet (Fortinet Advisory).