JSconsole access to Fortigate

[JimBo]

Today we received a security audit assessment from a 3rd party security company. They indicated they can login successfully to our border FortiGate firewall using jsconsole from a trusted management interface. The trusted management interface is connected to the Out-of-band (OOB) Management network and is restricted to specific internal users including the 3rd party security company performing the audit.

Can anyone speak to this access, good, bad, indifferent?

Can jsconsole be used to make changes to the firewall?

Is there a way to block jsconsole access?

Thank you

[mpapisetty]

Hi @JimBo ,

If the access is from a trusted management interface from a known user and with the appropriate credentials, I do not see any concern. 

I believe JSConsole would be able to access most GUI based applications and not just FortiGate for APIs, automation, debugging etc. Did the 3rd party security company raise a specific concern about this access? 

With regards to the other question of blocking access, I believe the only access control is based on protocols allowed on an interface (like ssh, https, ping etc). If JSConsole is using an allowed protocol on an interface, it would be able to access the firewall. 

[JimBo]

Hi Manoj,

Thanks for the quick follow up. I just watched a few youtube videos on JSconsole and must admit this is a powerful tool and potentially dangerous in the wrong hands.

The security company will provide their report next week when all management staff are back in the office. I’m attempting to have some type of valid educated response to any surprises.

Wondering if a valid user with admin view-only access could make changes to the firewall using JSconsole. I would assume no but confirmation would allow us to breathe a little easier.

Additionally, I only allow 443 access via the dedicated Mgt interface from the OOB Mgt net, so it appears JSconsole is using HTTPS for this access from the protected network, so this is contained to users allowed on the OOB Mgt Net! Firewall access is also allowed from FortiGate Cloud and this is accepted as safe too. Could an application-level security policy be applied to block JSconsole or some other method to manage control?

Thank you again for your feedback

JimBo

[mpapisetty · Accepted solution]

Hi @JimBo ,

Thanks for the clarification. I agree that JSConsole is a powerful tool. 

For admin access, there is no way to configure a policy based on application. The only way to restrict access is to have local in policies that can limit the IPs and services which can access the firewall. 

Which version is the firewall running on? A valid user with view-only should not be able to make changes. That would be a vulnerability. 

[MohammedYasin]

Dear @mpapisetty 

we are receiving email 

ate=2025-02-19 time=20:44:50 devid="FGT60" devname="Kpostfirewall2" eventtime=1739987089999680013 tz="+0300" logid="0100032001" type="event" subtype="system" level="information" vd="root" logdesc="Admin login successful" sn="1739987089" user="admin" ui="jsconsole" method="jsconsole" srcip=13.37.13.37 dstip=13.37.13.37 action="login" status="success" reason="none" profile="super_admin" msg="Administrator admin logged in successfully from jsconsole"

but this ip we don’t know and i check the system event admin loggin and next minute logout showing now i canged my password and i make restricted ip also again from my pc ip jsconsole logggin successfully showing now i remove wan wire please help me in this case

[mpapisetty]

Hi @MohammedYasin - 

Please be aware of the PSIRT that was published after my last comment - 

https://www.fortiguard.com/psirt/FG-IR-24-535 - and take actions accordingly.