What is 'allow an authorized attacker' in FG-IR-23-460

[ballistyx]

Hello.

I read the article FG-IR-23-460 that was released last month.
https://www.fortiguard.com/psirt/FG-IR-23-460

The document contained the phrase 'allow an authorized attacker'. While this doesn't change the fact that I need to apply the security patch, I can't imagine what kind of attacker this is or how easy it would be to launch an attack, so if anyone knows, please let me know.

1. Is "allow an authorized attacker" correct as an attacker who has been authenticated by FortiOS (i.e. an actor who has gained unauthorized access)?
2. Is my understanding that in order to exploit this vulnerability, the attacker must be able to reach the FortiOS command line interpreter correct?

Best Regards,

[akumar02]

Hello Ballistyx,

The command line interpreter of FortiOS may allow an authenticated attacker to execute unauthorized code or commands via specially crafted command line arguments.

1. Is "allow an authorized attacker" correct as an attacker who has been authenticated by FortiOS (i.e. an actor who has gained unauthorized access)?

Ans: Yes if you are running the affected FortiOS versions then unauthorised attackers may get access to your FortiOS command line. 

2. Is my understanding that in order to exploit this vulnerability, the attacker must be able to reach the FortiOS command line interpreter correct?

Ans: Correct. 

Kindly upgrade to the below-mentioned FortiOS to avoid this attack. 

https://www.fortiguard.com/psirt/FG-IR-23-460