JSconsole access to Fortigate

Forum|Forum|1 year ago
January 9, 2025
5 replies
7889 views

Today we received a security audit assessment from a 3rd party security company. They indicated they can login successfully to our border FortiGate firewall using jsconsole from a trusted management interface. The trusted management interface is connected to the Out-of-band (OOB) Management network and is restricted to specific internal users including the 3rd party security company performing the audit.

Can anyone speak to this access, good, bad, indifferent?

Can jsconsole be used to make changes to the firewall?

Is there a way to block jsconsole access?

Thank you

FortiGate

Best answer by mpapisetty

Hi @JimBo ,

Thanks for the clarification. I agree that JSConsole is a powerful tool.

For admin access, there is no way to configure a policy based on application. The only way to restrict access is to have local in policies that can limit the IPs and services which can access the firewall.

Which version is the firewall running on? A valid user with view-only should not be able to make changes. That would be a vulnerability.

mpapisetty

Staff

Hi @JimBo ,

If the access is from a trusted management interface from a known user and with the appropriate credentials, I do not see any concern.

I believe JSConsole would be able to access most GUI based applications and not just FortiGate for APIs, automation, debugging etc. Did the 3rd party security company raise a specific concern about this access?

With regards to the other question of blocking access, I believe the only access control is based on protocols allowed on an interface (like ssh, https, ping etc). If JSConsole is using an allowed protocol on an interface, it would be able to access the firewall.

JimBoAuthor

Explorer

Hi Manoj,

Thanks for the quick follow up. I just watched a few youtube videos on JSconsole and must admit this is a powerful tool and potentially dangerous in the wrong hands.

The security company will provide their report next week when all management staff are back in the office. I’m attempting to have some type of valid educated response to any surprises.

Wondering if a valid user with admin view-only access could make changes to the firewall using JSconsole. I would assume no but confirmation would allow us to breathe a little easier.

Additionally, I only allow 443 access via the dedicated Mgt interface from the OOB Mgt net, so it appears JSconsole is using HTTPS for this access from the protected network, so this is contained to users allowed on the OOB Mgt Net! Firewall access is also allowed from FortiGate Cloud and this is accepted as safe too. Could an application-level security policy be applied to block JSconsole or some other method to manage control?

Thank you again for your feedback

JimBo

mpapisettyAnswer

Staff

Hi @JimBo ,

Thanks for the clarification. I agree that JSConsole is a powerful tool.

For admin access, there is no way to configure a policy based on application. The only way to restrict access is to have local in policies that can limit the IPs and services which can access the firewall.

Which version is the firewall running on? A valid user with view-only should not be able to make changes. That would be a vulnerability.

Sign up

Login with SSO

Login to the community

Login with SSO