CVE-2022-41328: Fortinet FortiOS Path Traversal Flaw

CVE-2022-41328 Overview

CVE-2022-41328 is a path traversal vulnerability (CWE-22) affecting Fortinet FortiOS that allows a privileged attacker to read and write arbitrary files on the underlying Linux system via crafted CLI commands. This vulnerability enables attackers with existing access to the FortiOS command-line interface to escape directory restrictions and manipulate sensitive system files, potentially leading to complete device compromise.

Critical Impact

This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations using affected FortiOS versions should apply patches immediately as threat actors have leveraged this flaw in targeted attacks against critical infrastructure.

Affected Products

• Fortinet FortiOS version 7.2.0 through 7.2.3
• Fortinet FortiOS version 7.0.0 through 7.0.9
• Fortinet FortiOS versions before 6.4.11

Discovery Timeline

• 2023-03-07 - CVE CVE-2022-41328 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2022-41328

Vulnerability Analysis

This path traversal vulnerability exists in Fortinet FortiOS's command-line interface (CLI) command processing logic. The root issue stems from improper limitation of pathname handling that fails to adequately restrict file operations to authorized directories. When processing certain CLI commands, the FortiOS firmware does not properly sanitize user-supplied path components, allowing an authenticated attacker to traverse outside the intended directory structure.

The vulnerability requires local access with existing privileges on the FortiOS device, meaning the attacker must first obtain valid credentials or have pre-existing access to the CLI. Once access is achieved, the attacker can craft specially formatted CLI commands that include directory traversal sequences (such as ../) to escape restricted directories.

Root Cause

The vulnerability originates from improper input validation in the FortiOS CLI command parser. When the CLI processes file-related commands, it fails to properly normalize and validate path inputs before performing file operations. This allows the inclusion of relative path components that enable traversal outside the intended working directory, ultimately providing access to arbitrary locations on the underlying Linux filesystem.

Attack Vector

The attack requires local access to the FortiOS CLI with some level of authenticated privileges. An attacker exploiting this vulnerability would:

1. Obtain authenticated access to the FortiOS command-line interface
2. Craft malicious CLI commands containing path traversal sequences
3. Execute these commands to read sensitive files (e.g., configuration files, certificates, credentials)
4. Write malicious content to system files to achieve persistence or further compromise

The path traversal attack enables both read and write operations on the underlying Linux system, which could allow attackers to extract sensitive configuration data, modify system files for persistence, or plant malicious code that survives device reboots.

Detection Methods for CVE-2022-41328

Indicators of Compromise

• Unexpected modifications to system files outside normal FortiOS operational directories
• Suspicious CLI command history entries containing directory traversal sequences (../)
• Unauthorized access to sensitive configuration files or certificates
• Anomalous file access patterns in FortiOS system logs
• Presence of unexpected files in system directories that may indicate attacker persistence mechanisms

Detection Strategies

• Review FortiOS CLI command logs for commands containing path traversal patterns such as ../ or absolute paths to sensitive directories
• Implement file integrity monitoring on FortiOS devices to detect unauthorized modifications to critical system files
• Monitor for authentication events followed by unusual file access patterns that may indicate exploitation attempts
• Deploy network detection rules to identify potential command and control traffic associated with post-exploitation activities

Monitoring Recommendations

• Enable comprehensive logging on all FortiOS devices and forward logs to a centralized SIEM for analysis
• Configure alerts for CLI sessions from unusual source IPs or at unusual times
• Monitor for changes to FortiOS firmware integrity that could indicate tampering
• Implement baseline monitoring of normal CLI command patterns to identify anomalies

How to Mitigate CVE-2022-41328

Immediate Actions Required

• Immediately update all FortiOS devices to patched versions: FortiOS 7.2.4 or later, FortiOS 7.0.10 or later, or FortiOS 6.4.11 or later
• Review CLI access logs for evidence of exploitation attempts
• Restrict CLI access to only authorized administrators from known, trusted IP addresses
• Implement multi-factor authentication for all FortiOS administrative access
• Conduct forensic analysis of any devices suspected of compromise before returning them to production

Patch Information

Fortinet has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• FortiOS 7.2.x: Upgrade to version 7.2.4 or later
• FortiOS 7.0.x: Upgrade to version 7.0.10 or later
• FortiOS 6.4.x: Upgrade to version 6.4.11 or later

Refer to the FortiGuard Security Advisory FG-IR-22-369 for complete patch information and additional guidance.

Workarounds

• Restrict CLI access to a limited set of trusted administrators until patches can be applied
• Implement strict network segmentation to limit access to FortiOS management interfaces
• Use dedicated management networks that are isolated from user traffic and the internet
• Disable unnecessary CLI features and commands where possible through FortiOS access profiles
• Monitor all administrative access closely for suspicious activity pending patching

# Example: Restrict CLI access to specific trusted hosts
config system admin
    edit "admin"
        set trusthost1 192.168.1.0 255.255.255.0
        set trusthost2 10.0.0.5 255.255.255.255
    next
end