FortiClient 7.4.3 VPN Voulnerability

[GGrzelak]

Hi, our Scom team raised the following voulnearbility in 7.4.3. Support offers upgrade to PAID! version 7.4.4. and doesn’t offer any vulnerability mitigation process. Is that normal approach in Fortinet??

Summary: An Uncontrolled Search Path Element vulnerability (CWE-427) exists in FortiClient Windows versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, and all versions of 7.0. This vulnerability allows a local low-privileged user to execute a DLL hijacking attack by placing a malicious DLL in the FortiClient Online Installer installation folder. Impact: Exploitation of this vulnerability could enable unauthorized execution of malicious code, potentially compromising system integrity and security. Remediation: Upgrade to the latest version of Fortinet Forticlient.

[AEK]

Hi

Yes this is normal approach in all vendors, not only Fortinet, when the software is free and there is a mention that there is no obligation from the vendor to support with any issue related to the free software.

Nevertheless for this specific vulnerability there is a workaround that makes your system safe if you apply it during FCT VPN installation process.

Ref: https://www.fortiguard.com/psirt/FG-IR-25-685

Workaround
Ensure that all executables are downloaded directly from Fortinet, and run the installation of FortiClient from a folder non-writeable by regular users.

Hope it helps.