JSconsole access to Fortigate

[JimBo]

Today we received a security audit assessment from a 3rd party security company. They indicated they can login successfully to our border FortiGate firewall using jsconsole from a trusted management interface. The trusted management interface is connected to the Out-of-band (OOB) Management network and is restricted to specific internal users including the 3rd party security company performing the audit.

Can anyone speak to this access, good, bad, indifferent?

Can jsconsole be used to make changes to the firewall?

Is there a way to block jsconsole access?

Thank you

[mpapisetty]

Hi @JimBo ,

If the access is from a trusted management interface from a known user and with the appropriate credentials, I do not see any concern. 

I believe JSConsole would be able to access most GUI based applications and not just FortiGate for APIs, automation, debugging etc. Did the 3rd party security company raise a specific concern about this access? 

With regards to the other question of blocking access, I believe the only access control is based on protocols allowed on an interface (like ssh, https, ping etc). If JSConsole is using an allowed protocol on an interface, it would be able to access the firewall. 

[JimBo]

Hi Manoj,

Thanks for the quick follow up. I just watched a few youtube videos on JSconsole and must admit this is a powerful tool and potentially dangerous in the wrong hands.

The security company will provide their report next week when all management staff are back in the office. I’m attempting to have some type of valid educated response to any surprises.

Wondering if a valid user with admin view-only access could make changes to the firewall using JSconsole. I would assume no but confirmation would allow us to breathe a little easier.

Additionally, I only allow 443 access via the dedicated Mgt interface from the OOB Mgt net, so it appears JSconsole is using HTTPS for this access from the protected network, so this is contained to users allowed on the OOB Mgt Net! Firewall access is also allowed from FortiGate Cloud and this is accepted as safe too. Could an application-level security policy be applied to block JSconsole or some other method to manage control?

Thank you again for your feedback

JimBo