CVE-2023-45590: Fortinet FortiClient RCE Vulnerability

CVE-2023-45590 Overview

CVE-2023-45590 is a code injection vulnerability affecting Fortinet FortiClientLinux, specifically versions 7.2.0, 7.0.6 through 7.0.10, and 7.0.3 through 7.0.4. This vulnerability allows an attacker to execute unauthorized code or commands by tricking a FortiClientLinux user into visiting a malicious website. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code).

Critical Impact

Attackers can achieve remote code execution on FortiClientLinux endpoints by luring users to malicious websites, potentially compromising enterprise VPN infrastructure and gaining unauthorized access to corporate networks.

Affected Products

• Fortinet FortiClientLinux version 7.2.0
• Fortinet FortiClientLinux versions 7.0.6 through 7.0.10
• Fortinet FortiClientLinux versions 7.0.3 through 7.0.4

Discovery Timeline

• April 9, 2024 - CVE-2023-45590 published to NVD
• January 17, 2025 - Last updated in NVD database

Technical Details for CVE-2023-45590

Vulnerability Analysis

This vulnerability stems from improper control of code generation within the FortiClientLinux application. The flaw allows attackers to inject malicious code that gets executed in the context of the FortiClientLinux user session. Since FortiClient is a VPN and endpoint protection agent that often runs with elevated privileges, successful exploitation could provide attackers with significant access to the underlying Linux system.

The attack requires user interaction—specifically, the victim must be tricked into visiting a malicious website while FortiClientLinux is active. This attack vector leverages network-based delivery with low attack complexity but depends on social engineering to lure the target to the attacker-controlled site.

Root Cause

The root cause of CVE-2023-45590 lies in CWE-94: Improper Control of Generation of Code ('Code Injection'). The FortiClientLinux application fails to properly sanitize or validate input that influences code generation, allowing attackers to inject arbitrary code. This type of vulnerability typically occurs when user-controlled data is incorporated into dynamically generated code without adequate filtering or encoding.

Attack Vector

The attack vector for this vulnerability is network-based and requires user interaction. An attacker must craft a malicious website designed to exploit the code injection flaw in FortiClientLinux. When a user running a vulnerable version of FortiClientLinux visits this malicious site, the injected code executes on the victim's system.

The exploitation chain typically involves:

1. Attacker sets up a malicious website containing crafted payloads
2. Victim is lured to the malicious site through phishing or other social engineering techniques
3. The malicious payload triggers the code injection vulnerability in FortiClientLinux
4. Unauthorized code executes with the privileges of the FortiClientLinux process

For detailed technical information about this vulnerability, refer to the FortiGuard Security Advisory.

Detection Methods for CVE-2023-45590

Indicators of Compromise

• Unexpected outbound connections from FortiClientLinux processes to unknown or suspicious domains
• Anomalous child processes spawned by FortiClientLinux components
• Unusual file creation or modification activities in FortiClient directories
• Evidence of browser-initiated communications triggering FortiClientLinux behavior

Detection Strategies

• Monitor FortiClientLinux process behavior for unexpected code execution or command-line activity
• Implement network monitoring to detect connections to known malicious infrastructure
• Deploy endpoint detection rules to identify unusual FortiClient process trees
• Review browser history and proxy logs for access to suspicious or newly registered domains

Monitoring Recommendations

• Enable detailed logging for FortiClientLinux operations and review logs regularly
• Configure SIEM rules to correlate web browsing activity with subsequent FortiClient process anomalies
• Implement DNS query monitoring to identify potential malicious domain access
• Deploy SentinelOne Singularity to provide real-time behavioral detection and response capabilities

How to Mitigate CVE-2023-45590

Immediate Actions Required

• Update FortiClientLinux to a patched version as specified in the FortiGuard Security Advisory
• Educate users about the risks of clicking links from untrusted sources
• Implement web filtering to block access to known malicious domains
• Consider temporarily restricting FortiClientLinux usage on critical systems until patched

Patch Information

Fortinet has released security patches to address this vulnerability. Organizations should update to the latest version of FortiClientLinux that addresses CVE-2023-45590. Detailed patch information and fixed versions are available in the FortiGuard Security Advisory FG-IR-23-087.

Workarounds

• Implement strict web filtering policies to prevent access to untrusted websites
• Use browser isolation technologies to sandbox web browsing sessions
• Apply network segmentation to limit the potential impact of compromised endpoints
• Enforce least privilege principles for users running FortiClientLinux

# Verify FortiClientLinux version
fcconfig -v

# Check for available updates through your package manager
# For Debian/Ubuntu-based systems:
apt list --installed | grep forticlient

# For RHEL/CentOS-based systems:
rpm -qa | grep forticlient