CVE-2023-27995: Fortinet FortiSOAR RCE Vulnerability

CVE-2023-27995 Overview

CVE-2023-27995 is a template engine injection vulnerability affecting Fortinet FortiSOAR, a security orchestration, automation, and response (SOAR) platform. The vulnerability stems from improper neutralization of special elements used in a template engine, allowing authenticated remote attackers to execute arbitrary code on affected systems through crafted payloads.

Critical Impact

Authenticated attackers can achieve remote code execution on FortiSOAR servers, potentially compromising the entire security operations infrastructure and gaining access to sensitive incident response data.

Affected Products

• Fortinet FortiSOAR version 7.3.0
• Fortinet FortiSOAR version 7.3.1
• Fortinet FortiSOAR versions between 7.3.0 and 7.3.1

Discovery Timeline

• 2023-04-11 - CVE-2023-27995 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-27995

Vulnerability Analysis

This vulnerability is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). Template injection vulnerabilities occur when user-controlled input is embedded into templates without proper sanitization, allowing attackers to inject template directives that are then interpreted by the template engine.

In the context of FortiSOAR, the platform processes template-based content for various automation and reporting functions. The vulnerable code path fails to properly neutralize special characters and template syntax elements before processing, enabling an authenticated attacker to inject malicious template directives that result in arbitrary code execution on the underlying server.

The attack requires network access and valid authentication credentials, but once authenticated, the attacker can leverage the template injection to break out of the template sandbox and execute system-level commands. Given FortiSOAR's role as a central security orchestration platform, successful exploitation could provide attackers with access to sensitive security data, incident response workflows, and potentially pivot access to integrated security tools.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization of user-supplied data before it is processed by the template engine. The application fails to properly escape or neutralize template-specific syntax and special characters, allowing the template engine to interpret malicious payloads as legitimate template directives rather than treating them as plain text.

Attack Vector

The attack is conducted remotely over the network by an authenticated user. The attacker crafts a malicious payload containing template engine directives and submits it through a vulnerable input field or API endpoint. When the application processes this input through its template engine without proper sanitization, the injected directives are executed, allowing the attacker to run arbitrary code with the privileges of the FortiSOAR application.

The vulnerability mechanism involves injecting template syntax that the engine interprets as executable code. For SOAR platforms that commonly use Python-based template engines like Jinja2, attackers may leverage object introspection techniques to access dangerous functions and execute system commands. Technical details regarding specific exploitation methods can be found in the FortiGuard PSIRT Advisory FG-IR-23-051.

Detection Methods for CVE-2023-27995

Indicators of Compromise

• Unusual template-related error messages in FortiSOAR application logs
• Unexpected process spawning or command execution originating from FortiSOAR service processes
• Network connections from FortiSOAR servers to unusual external destinations
• Modifications to system files or configurations on the FortiSOAR host

Detection Strategies

• Monitor FortiSOAR application logs for template parsing errors or suspicious input patterns
• Implement web application firewall (WAF) rules to detect template injection payload patterns in HTTP requests
• Review authentication logs for unusual login activity followed by suspicious API calls
• Deploy endpoint detection and response (EDR) solutions to identify anomalous process execution on FortiSOAR servers

Monitoring Recommendations

• Enable detailed logging for all FortiSOAR user actions and API requests
• Configure alerts for any command execution or subprocess spawning from FortiSOAR application processes
• Monitor network traffic from FortiSOAR servers for unusual outbound connections
• Implement user behavior analytics to detect credential compromise or insider threats

How to Mitigate CVE-2023-27995

Immediate Actions Required

• Upgrade FortiSOAR to a patched version as specified in the vendor advisory
• Review FortiSOAR user accounts and remove unnecessary access privileges
• Implement network segmentation to limit access to FortiSOAR management interfaces
• Enable comprehensive logging and monitoring on FortiSOAR systems

Patch Information

Fortinet has released security patches to address this vulnerability. Administrators should consult the FortiGuard PSIRT Advisory FG-IR-23-051 for specific patch information and upgrade instructions. Organizations should prioritize upgrading to FortiSOAR versions newer than 7.3.1 that contain the security fix.

Workarounds

• Restrict network access to FortiSOAR management interfaces using firewall rules or network ACLs
• Implement strict input validation at the network perimeter using WAF rules targeting template injection patterns
• Review and minimize the number of users with FortiSOAR access privileges
• Monitor for exploitation attempts while preparing for patch deployment

# Network access restriction example using iptables
# Restrict FortiSOAR management access to trusted admin networks only
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP