Clarity on Vulnerability FG-IR-23-225

[lemonduck]

I want to ask if this vulnerability can be deferred as it requires an authenticated vpn user. 

https://www.fortiguard.com/psirt/FG-IR-23-225 

[srajeswaran]

Yes, this vulnerability means a VPN user after the authentication/VPN connected successfully can send spoofed packets, if your credentials are secured then you don't have to worry about this vulnerability.

[pminarik]

From the link itself:

> An insufficient verification of data authenticity vulnerability [CWE-345] in FortiOS & FortiProxy SSL-VPN tunnel mode may allow an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.

In other words, yes, this can only be exploited by a VPN user who successfully authenticated and connected.

Also note the part "to send (but not receive) packets", which functionally restricts the potential abuse to UDP packets (TCP wont make it past SYN-ACK).

[lemonduck]

Thank you so much.

[pavankr5]

Hello @lemonduck ,

The vulnerability occurs due to inadequate verification of the authenticity of data in SSL-VPN tunnel mode. This allows a user who is authenticated on the VPN to send packets that appear to originate from another user's IP address. However, the attacker cannot receive packets sent to the spoofed IP address. The issue can be resolved by upgrading to the specified versions or migrating to a fixed release as recommended.

let us know if you have any queries.

Thanks,

Pavan