CVE-2021-41031: Fortinet FortiClient Path Traversal Flaw

CVE-2021-41031 Overview

CVE-2021-41031 is a relative path traversal vulnerability [CWE-23] in FortiClient for Windows. The flaw resides in the named pipe used by the FortiESNAC service. A local unprivileged attacker can exploit the issue to escalate privileges to SYSTEM on affected hosts. The vulnerability affects FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior, and 6.2.9 and below. Fortinet published the issue under advisory FG-IR-21-190.

Critical Impact
Local unprivileged users can escalate to SYSTEM privileges on Windows endpoints running vulnerable FortiClient builds, giving attackers full control over the compromised host.

Affected Products

FortiClient for Windows 7.0.2 and prior
FortiClient for Windows 6.4.6 and prior
FortiClient for Windows 6.2.9 and below

Discovery Timeline

2022-07-18 - CVE-2021-41031 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-41031

Vulnerability Analysis

The vulnerability is a relative path traversal flaw classified under [CWE-23]. It is reachable through the named pipe exposed by the FortiESNAC service. The FortiESNAC component runs with SYSTEM privileges on Windows endpoints. A local attacker with low privileges can craft input containing relative path sequences such as ..\ and pass it through the named pipe interface. The service does not adequately normalize or validate the supplied path before performing privileged file operations. The result is a local elevation of privilege from a standard user account to SYSTEM.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory in the FortiESNAC named pipe handler. The service trusts path input received over the pipe and resolves it relative to a controlled location without rejecting parent directory traversal sequences. Because the named pipe is accessible to local non-administrative users, the privileged file operation can be redirected to attacker-controlled targets.

Attack Vector

Exploitation requires local access and low privileges, with no user interaction. An attacker connects to the FortiESNAC named pipe from an unprivileged session and submits crafted path data containing traversal sequences. The privileged service performs the file operation outside the intended directory, enabling the attacker to write, replace, or load resources executed in the SYSTEM context. A successful attack yields full confidentiality, integrity, and availability impact on the local host.

Vulnerability mechanism (descriptive, no public PoC available):

1. Unprivileged user opens handle to the FortiESNAC named pipe.
2. User submits a message containing a relative path such as
   "..\..\Windows\System32\<target>".
3. FortiESNAC (running as SYSTEM) resolves the path without
   rejecting traversal sequences.
4. Privileged file operation executes outside the intended
   directory, enabling SYSTEM-level code execution.

Detection Methods for CVE-2021-41031

Indicators of Compromise

Unexpected child processes spawned by FortiESNAC.exe or other FortiClient service binaries running as SYSTEM.
New or modified executables, DLLs, or configuration files in FortiClient installation directories created by non-administrative user sessions.
Named pipe connections to FortiClient pipes originating from unusual user contexts or short-lived processes.

Detection Strategies

Inventory installed FortiClient versions across Windows endpoints and flag hosts running 7.0.2, 6.4.6, or 6.2.9 and earlier builds.
Monitor for low-privileged processes interacting with FortiClient named pipes followed by privileged file writes.
Correlate file creation events under FortiClient directories with the originating user SID to identify privilege transitions.

Monitoring Recommendations

Enable Windows object access auditing for FortiClient installation paths and named pipe endpoints.
Forward Sysmon events 1 (process create), 11 (file create), and 17/18 (named pipe events) to a centralized logging platform for correlation.
Alert on any non-SYSTEM process that triggers immediate SYSTEM-context activity tied to FortiClient services.

How to Mitigate CVE-2021-41031

Immediate Actions Required

Upgrade FortiClient for Windows to a fixed version as listed in Fortinet advisory FG-IR-21-190.
Identify all Windows endpoints running vulnerable FortiClient builds and prioritize patching on multi-user systems and jump hosts.
Restrict local interactive logon to FortiClient-protected hosts where patching cannot be completed immediately.

Patch Information

Fortinet addressed the vulnerability in FortiClient for Windows versions later than 7.0.2, 6.4.6, and 6.2.9. Refer to the FortiGuard Security Advisory FG-IR-21-190 for the authoritative list of fixed releases and upgrade guidance.

Workarounds

No vendor-supplied workaround is documented; upgrading to a fixed FortiClient release is the supported remediation.
Limit local logon rights on endpoints to reduce the population of users able to reach the FortiESNAC named pipe.
Apply application control to block unauthorized binaries from executing within FortiClient installation directories.

bash

# PowerShell: enumerate installed FortiClient version on Windows endpoints
Get-ItemProperty "HKLM:\SOFTWARE\Fortinet\FortiClient\FA_VPN" `
  -ErrorAction SilentlyContinue | Select-Object Version

Get-CimInstance Win32_Product `
  -Filter "Name LIKE 'FortiClient%'" | `
  Select-Object Name, Version, InstallDate