CISA adds FortiClient EMS, Ivanti EPM CSA, Nice Linear eMerge E3-Series bugs to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds FortiClient EMS, Ivanti EPM CSA, Nice Linear eMerge E3-Series bugs to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

• CVE-2023-48788 Fortinet FortiClient EMS SQL Injection Vulnerability
• CVE-2021-44529 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
• CVE-2019-7256 Nice Linear eMerge E3-Series OS Command Injection Vulnerability

CVE-2023-48788 (CVSS score 9.3) is a critical pervasive SQL injection issue that resides in the DAS component.

“An improper neutralization of special elements used in an SQL Command (‘SQL Injection’) vulnerability [CWE-89] in FortiClientEMS may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted requests.” reads the advisory.

Thiago Santana from the ForticlientEMS development team and UK NCSC reported the issue to the security vendor.

Last week security researchers at Horizon3 released a proof-of-concept (PoC) exploit for a critical vulnerability, tracked as CVE-2023-48788 (CVSS score 9.3), in Fortinet’s FortiClient Enterprise Management Server (EMS) software. The vulnerability is now actively exploited in attacks in the wild.

The initial advisory reported that Fortinet was not aware of attacks in the wild exploiting this vulnerability.

However, the company has updated the advisory confirming that “this vulnerability is exploited in the wild.”

Horizon3’s Attack Team published a technical analysis of this vulnerability and the PoC exploit. The researchers demonstrated how to turn this SQL injection issue into remote code execution using the built-in xp_cmdshell functionality of Microsoft SQL Server.

The researchers explained that the database was not configured to run the xp_cmdshell command, however it was possible to do it using a few other SQL statements.

“The POC we are releasing only confirms the vulnerability by using a simple SQL injection without xp_cmdshell. To enable RCE, altering the POC is necessary.” reads the analysis published by Horizon3.

“There are various log files in C:\Program Files (x86)\Fortinet\FortiClientEMS\logs that can be examined for connections from unrecognized clients or other malicious activity. The MS SQL logs can also be examined for evidence of xp_cmdshell being utilized to obtain command execution.”

The second vulnerability added to the Known Exploited Vulnerabilities catalog is CVE-2021-44529. The issue is a code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA), an unauthenticated user can exploit the flaw to execute arbitrary code with limited permissions (nobody).

The third issue added to the catalog by CISA is a Command Injection flaw in Linear eMerge E3-Series devices.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix this vulnerability by April 15, 2024.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – Hacking, Known Exploited Vulnerabilities catalog)