PSIRT Advisories

FortiOS & FortiProxy - Information disclosure in web proxy error pages

Summary

A server-generated error message containing sensitive information vulnerability [CWE-550] in FortiOS and FortiProxy web proxy may allow a malicious webserver to retrieve a web proxy's client username and IP via same origin HTTP requests triggering proxy-generated HTTP status codes pages.

Affected Products

FortiOS version 7.0.3 and below,
FortiOS version 6.4.9 and below,
FortiOS version 6.2.10 and below,
FortiOS version 6.0.14 and below.

FortiProxy version 7.0.1 and below,
FortiProxy version 2.0.x

Solutions

Please upgrade to FortiOS version 7.2.0 or above.

Please upgrade to FortiOS version 7.0.4 or above.

Please upgrade to FortiOS upcoming version 6.4.10 or above.

Please upgrade to FortiOS version 6.2.11 or above.

Please upgrade to FortiProxy version 7.0.2 or above.

Acknowledgement

Fortinet is pleased to thank Tom Tervoort from Secura for bringing this issue to our attention under responsible disclosure.