CVE-2023-28001: Fortinet FortiOS Auth Bypass Vulnerability

CVE-2023-28001 Overview

CVE-2023-28001 is an insufficient session expiration vulnerability affecting Fortinet FortiOS versions 7.0.0 through 7.0.12 and 7.2.0 through 7.2.4. This security flaw allows an attacker to execute unauthorized code or commands by reusing the session of a deleted user in the REST API. The vulnerability stems from improper session management (CWE-613), where session tokens remain valid even after the associated user account has been deleted from the system.

Critical Impact

Attackers can gain unauthorized access to FortiOS management interfaces by exploiting lingering session tokens of deleted users, potentially leading to full system compromise of affected Fortinet firewalls and security appliances.

Affected Products

• Fortinet FortiOS 7.0.0 - 7.0.12
• Fortinet FortiOS 7.2.0 - 7.2.4

Discovery Timeline

• 2023-07-11 - CVE-2023-28001 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-28001

Vulnerability Analysis

This insufficient session expiration vulnerability affects the REST API component of Fortinet FortiOS. The core issue lies in the session management implementation, where authentication tokens associated with user accounts are not properly invalidated when those accounts are deleted from the system. This creates a dangerous window where an attacker who has obtained a valid session token—whether through credential theft, session hijacking, or other means—can continue to use that token to authenticate and execute privileged operations even after the legitimate user's account has been removed.

The vulnerability is particularly concerning in enterprise environments where user account lifecycle management is common. When administrators delete user accounts as part of standard offboarding procedures or security incident response, they reasonably expect that all associated access credentials and sessions will be immediately revoked. This vulnerability breaks that assumption, leaving a persistent backdoor into the FortiOS management plane.

Root Cause

The root cause of CVE-2023-28001 is improper session lifecycle management within the FortiOS REST API authentication framework. When a user account is deleted, the system fails to enumerate and invalidate all active session tokens associated with that account. Session tokens are likely stored or validated independently from the user account status, allowing them to remain valid beyond the account's existence. This represents a failure to implement proper session binding to account state, a fundamental security control for session management systems.

Attack Vector

The attack vector for this vulnerability is network-based and requires no user interaction. An attacker must first obtain a valid session token from a FortiOS user account. This could be achieved through various means such as phishing, credential stuffing, insider access, or exploiting other vulnerabilities. Once the attacker has a valid session token, they can maintain persistent access to the FortiOS REST API even after the compromised account is discovered and deleted by administrators.

The exploitation scenario typically unfolds as follows: An attacker compromises a user account and extracts or hijacks the REST API session token. Security teams detect the compromise and delete the user account as part of incident response. The attacker continues to use the previously obtained session token to access the REST API and execute commands with the privileges of the deleted account. This allows the attacker to maintain their foothold despite remediation efforts.

Detection Methods for CVE-2023-28001

Indicators of Compromise

• REST API authentication activity from session tokens associated with accounts that no longer exist in the user database
• Continued API calls from IP addresses or user agents previously associated with deleted user accounts
• Authentication logs showing successful API access without corresponding valid user account records
• Anomalous REST API activity patterns following user account deletion events

Detection Strategies

• Implement correlation rules to alert on REST API authentication events where the associated user account does not exist
• Monitor for REST API session activity that persists beyond user account deletion timestamps
• Deploy FortiOS audit logging to capture all REST API authentication and command execution events
• Create alerts for any API activity from session tokens that were issued before their associated accounts were deleted

Monitoring Recommendations

• Enable comprehensive logging on FortiOS REST API endpoints with session token tracking
• Implement SIEM correlation between FortiOS user management events and API authentication logs
• Establish baseline patterns for REST API usage and alert on deviations following account modifications
• Configure real-time alerting for any failed session validation events that reference non-existent users

How to Mitigate CVE-2023-28001

Immediate Actions Required

• Upgrade affected FortiOS installations to patched versions as specified in the FortiGuard Security Advisory
• Review and audit all active REST API sessions, terminating any sessions that cannot be mapped to active user accounts
• Implement network segmentation to restrict REST API access to authorized management networks only
• Enable multi-factor authentication for all FortiOS administrative access where available

Patch Information

Fortinet has released security updates to address this vulnerability. Administrators should upgrade to FortiOS versions newer than 7.0.12 (for the 7.0.x branch) or newer than 7.2.4 (for the 7.2.x branch). Detailed patch information and download links are available in the FortiGuard Security Advisory FG-IR-23-028. Organizations should prioritize patching internet-facing FortiOS devices and those managing critical network segments.

Workarounds

• Restrict REST API access to trusted management networks only using firewall rules and access control lists
• Implement a manual session invalidation procedure that terminates all REST API sessions when user accounts are deleted
• Consider disabling REST API access entirely if not required for operational purposes until patching can be completed
• Deploy additional network monitoring on REST API endpoints to detect unauthorized access attempts

# Configuration example - Restrict REST API access to management VLAN only
config system interface
    edit "mgmt"
        set allowaccess https ssh ping
        set ip 10.0.1.1 255.255.255.0
    next
end

config firewall local-in-policy
    edit 1
        set intf "any"
        set srcaddr "MGMT_NETWORK"
        set dstaddr "all"
        set service "HTTPS"
        set schedule "always"
        set action accept
    next
    edit 2
        set intf "any"
        set srcaddr "all"
        set dstaddr "all"
        set service "HTTPS"
        set schedule "always"
        set action deny
    next
end