CVE-2022-23438: Fortinet FortiOS XSS Vulnerability

CVE-2022-23438 Overview

CVE-2022-23438 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the captive portal authentication replacement page in Fortinet FortiOS. The vulnerability stems from improper neutralization of input during web page generation (CWE-79), allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the context of a victim's browser session.

This vulnerability affects network edge security appliances that are commonly deployed to protect enterprise networks, making it a concern for organizations relying on FortiGate firewalls for perimeter security and guest network access control.

Critical Impact

Unauthenticated attackers can leverage the captive portal to perform reflected XSS attacks, potentially stealing user credentials, session tokens, or performing actions on behalf of authenticated users accessing the FortiOS web interface.

Affected Products

• Fortinet FortiOS version 7.0.5 and prior
• Fortinet FortiOS version 6.4.9 and prior
• Fortinet FortiGate appliances running affected FortiOS versions

Discovery Timeline

• 2022-07-18 - CVE-2022-23438 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-23438

Vulnerability Analysis

This vulnerability is classified as a reflected Cross-Site Scripting (XSS) flaw located in the captive portal authentication replacement page of FortiOS. The captive portal feature is commonly used for guest network authentication, employee onboarding networks, and public WiFi access scenarios.

Reflected XSS vulnerabilities occur when user-supplied input is immediately reflected back in the web response without proper sanitization or encoding. In this case, the captive portal authentication page fails to adequately neutralize malicious input, allowing attackers to craft URLs containing JavaScript payloads that execute when victims access the malicious link.

The network-based attack vector combined with no authentication requirements means attackers can target any user who accesses the captive portal, including network administrators, guests, or employees. The vulnerability requires user interaction, as victims must click a malicious link or be redirected to the crafted URL.

Root Cause

The root cause is improper input sanitization in the captive portal authentication replacement page. When rendering the authentication page, FortiOS fails to properly encode or escape user-controlled input parameters before including them in the HTML response. This allows attackers to inject arbitrary HTML or JavaScript code that gets executed in the victim's browser context.

The vulnerability specifically manifests in the authentication replacement page component, which is designed to redirect users or display authentication prompts. Input fields or URL parameters that are reflected into the page content do not undergo sufficient XSS filtering, enabling script injection attacks.

Attack Vector

The attack vector for CVE-2022-23438 involves crafting a malicious URL targeting the FortiOS captive portal. An attacker would:

1. Identify a FortiOS device with captive portal enabled and accessible over the network
2. Craft a URL containing malicious JavaScript payload in vulnerable parameters
3. Distribute the malicious link via phishing emails, social engineering, or man-in-the-middle injection
4. When a victim clicks the link, the malicious script executes in their browser with the context of the FortiOS web interface

The vulnerability enables session hijacking, credential theft, or unauthorized actions if the victim has an active session with the FortiOS management interface. Attackers can also use this to capture credentials entered into fake login forms injected via the XSS payload.

Detection Methods for CVE-2022-23438

Indicators of Compromise

• Unusual URL patterns in web server logs containing encoded JavaScript or HTML tags targeting captive portal endpoints
• Reports of unexpected browser behavior or pop-ups when accessing the captive portal
• Suspicious redirects from the captive portal to external domains
• Login attempts or credential submissions to unexpected endpoints following captive portal access

Detection Strategies

• Implement web application firewall (WAF) rules to detect XSS payload patterns in requests to FortiOS captive portal URLs
• Monitor FortiOS web server access logs for requests containing suspicious encoded characters such as %3Cscript%3E or javascript: sequences
• Configure network intrusion detection systems to alert on common XSS attack signatures targeting the captive portal
• Review authentication logs for anomalous session behavior following captive portal access

Monitoring Recommendations

• Enable detailed logging on FortiOS web services and forward logs to a SIEM for correlation
• Monitor for increased traffic to the captive portal authentication pages from unusual source IPs
• Track browser-based alerts or complaints from users accessing the captive portal
• Implement Content Security Policy (CSP) monitoring to detect inline script execution attempts

How to Mitigate CVE-2022-23438

Immediate Actions Required

• Upgrade FortiOS to version 7.0.6 or later for the 7.0.x branch
• Upgrade FortiOS to version 6.4.10 or later for the 6.4.x branch
• Review and restrict access to the captive portal from untrusted networks where feasible
• Implement network segmentation to limit exposure of the captive portal interface

Patch Information

Fortinet has released security patches addressing this vulnerability. Administrators should consult the FortiGuard Security Advisory FG-IR-21-057 for detailed patch information and upgrade guidance. The advisory provides version-specific remediation instructions and additional hardening recommendations.

For environments where immediate patching is not possible, Fortinet may provide interim mitigations in the advisory. Organizations should prioritize patching given the network-accessible nature of captive portals and the potential for credential theft.

Workarounds

• Restrict captive portal access to trusted network segments using firewall rules until patching is complete
• Implement a web application firewall in front of the FortiOS device to filter XSS payloads
• Disable the captive portal feature if not required for business operations
• Use alternative authentication mechanisms that do not rely on the vulnerable captive portal page

# Example: Restrict captive portal interface access (FortiOS CLI)
config firewall address
    edit "trusted-networks"
        set subnet 10.0.0.0 255.0.0.0
    next
end

config firewall policy
    edit 0
        set srcaddr "trusted-networks"
        set dstintf "captive-portal-interface"
        set action accept
    next
end