When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb (??) Auth. Bypass) · watchTowr Labs
Source Reddit NetSec
Description
A medium-severity authentication bypass vulnerability has been reported involving the impersonation function in Fortinet FortiWeb web application firewalls. This flaw allows an attacker to impersonate users by exploiting the impersonation feature, potentially bypassing authentication controls. Although no known exploits are currently in the wild and no affected versions or patches have been specified, the vulnerability could enable unauthorized access to protected resources. European organizations using Fortinet FortiWeb appliances should be aware of this risk, especially those in critical infrastructure and sectors relying heavily on Fortinet products. Mitigation requires close monitoring of vendor advisories, restricting access to impersonation functions, and implementing strict access controls. Countries with high Fortinet market penetration and strategic importance, such as Germany, France, and the UK, are most likely to be impacted. Given the potential for unauthorized access without user interaction, the threat is assessed as high severity. Defenders should prioritize detection of unusual impersonation activity and prepare for rapid patch deployment once available.