CVE-2022-22303: Fortinet FortiManager Info Disclosure Flaw

CVE-2022-22303 Overview

CVE-2022-22303 is an exposure of sensitive system information to an unauthorized control sphere vulnerability (CWE-497) affecting Fortinet FortiManager. This information disclosure flaw allows a low privileged authenticated user to gain access to FortiGate user credentials through the config conflict file, potentially compromising the security of managed network devices.

Critical Impact

Authenticated attackers with low privileges can extract FortiGate user credentials from config conflict files, enabling unauthorized access to managed firewall infrastructure.

Affected Products

• Fortinet FortiManager versions prior to 7.0.2
• Fortinet FortiManager versions prior to 6.4.7
• Fortinet FortiManager versions prior to 6.2.9

Discovery Timeline

• 2022-03-02 - CVE-2022-22303 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-22303

Vulnerability Analysis

This vulnerability stems from improper handling of sensitive credential information within FortiManager's configuration management system. When configuration conflicts occur between FortiManager and managed FortiGate devices, the system generates conflict files that inadvertently contain sensitive user credentials in a manner accessible to low-privileged authenticated users.

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the application fails to properly protect credential data from users who should not have access to it. The attack requires local access and low-level authentication, meaning an attacker must first obtain legitimate but limited access to the FortiManager system.

Root Cause

The root cause of CVE-2022-22303 lies in insufficient access controls and improper data sanitization within FortiManager's configuration conflict handling mechanism. When the system stores configuration conflict files, it fails to properly redact or restrict access to sensitive FortiGate user credentials embedded within these files. This allows authenticated users with minimal privileges to read credential information that should be restricted to administrative users only.

Attack Vector

The attack vector for this vulnerability requires local access to the FortiManager system with low-privilege authentication. An attacker who has obtained basic user credentials can navigate to or access the config conflict files stored by the system. These files, generated during normal configuration synchronization operations between FortiManager and FortiGate devices, contain unprotected user credentials.

The exploitation path involves:

1. Attaining low-privilege authenticated access to FortiManager
2. Locating config conflict files within the system
3. Reading the conflict file contents to extract FortiGate credentials
4. Using the extracted credentials to access managed FortiGate devices

Since no exploit code is publicly available for this vulnerability, and the attack requires authenticated access, the exploitation complexity is reduced for insider threats or attackers who have already compromised low-privilege accounts.

Detection Methods for CVE-2022-22303

Indicators of Compromise

• Unusual access patterns to configuration conflict files by non-administrative users
• Multiple failed or successful authentication attempts to FortiGate devices following FortiManager access
• Audit log entries showing low-privilege users accessing configuration management areas
• Unexpected credential usage on FortiGate devices from unrecognized sources

Detection Strategies

• Enable comprehensive audit logging for file access within FortiManager
• Monitor authentication logs on FortiGate devices for credential misuse following FortiManager access
• Implement user behavior analytics to detect anomalous access to configuration files
• Configure alerts for non-administrative users attempting to access configuration conflict storage locations

Monitoring Recommendations

• Review FortiManager access logs regularly for suspicious activity by low-privilege accounts
• Implement SIEM rules to correlate FortiManager file access with subsequent FortiGate authentication events
• Monitor for bulk access or enumeration of configuration files
• Establish baseline behavior for legitimate configuration management activities to identify deviations

How to Mitigate CVE-2022-22303

Immediate Actions Required

• Upgrade FortiManager to version 7.0.2, 6.4.7, or 6.2.9 or later depending on your version branch
• Review and restrict user access permissions within FortiManager to enforce least privilege
• Audit existing user accounts and remove unnecessary access
• Rotate FortiGate user credentials that may have been exposed

Patch Information

Fortinet has released security updates addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• FortiManager 7.0.2 or later (for 7.0.x branch)
• FortiManager 6.4.7 or later (for 6.4.x branch)
• FortiManager 6.2.9 or later (for 6.2.x branch)

For detailed patch information and download links, refer to the FortiGuard Security Advisory FG-IR-21-165.

Workarounds

• Restrict FortiManager access to only essential administrative personnel until patching is complete
• Implement network segmentation to limit access to FortiManager systems
• Enable multi-factor authentication for all FortiManager accounts
• Review and purge old configuration conflict files that may contain sensitive credentials
• Monitor for suspicious authentication activity on managed FortiGate devices

# Configuration example - Verify FortiManager version
# Connect to FortiManager CLI and check version
get system status
# Look for "Version:" in output to confirm patched version

# Review user permissions (FortiManager CLI)
diagnose debug application fgfmd 255
# Monitor for unauthorized access attempts