FortiOS/FortiProxy - SSL VPN portal is vulnerable to an XSS

Summary

Failure to sanitize input in the SSL VPN web portal may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters.

Affected Products

FortiGate versions 5.6.13 and below.
FortiGate versions 6.0.12 and below.
FortiGate versions 6.2.7 and below.
FortiGate versions 6.4.5 and below.
FortiProxy version 2.0.0 through 2.0.1
FortiProxy version 1.2.0 through 1.2.9

 

Solutions

Please upgrade to FortiGate version 6.0.13 or above.
Please upgrade to FortiGate version 6.2.8 or above.
Please upgrade to FortiGate version 6.4.6 or above.
Please upgrade to FortiGate version 7.0.0 or above.

For new high-end F-Series Models (FG-1800F, FG-3800F, FG-4200F, FG-4400F) please upgrade to 6.2.9

Please upgrade to FortiProxy version 2.0.2 or above.
Please upgrade to FortiProxy version 1.2.10 or above.

Acknowledgement

Fortinet is pleased to thank Damian Rusinek for reporting this issue under responsible disclosure.