CVE-2021-3378

published 2021-02-01

CVE-2021-3378: FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting…

Priority P1 81 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting Assets/temp/hotspot/img/logohotspot.asp.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
fortilogger	fortilogger	< 5.2.0	5.2.0

Detection & IOCs extracted from sources · hover to see the quote

url /Config/SaveUploadedHotspotLogoFile↗

url /Assets/temp/hotspot/img/logohotspot.asp↗

url /shared/GetProductInfo↗

port 5000↗

other X-Requested-With: XMLHttpRequest↗

filename logohotspot.asp↗

path /Assets/temp/hotspot/img/↗

• → Detect unauthenticated POST requests to /Config/SaveUploadedHotspotLogoFile with a multipart/form-data body containing 'Content-Type: image/png' — this is the upload vector for the webshell. ↗
• → Detect subsequent GET requests to /Assets/temp/hotspot/img/logohotspot.asp (or .txt variant) immediately after the upload POST — this is the webshell execution step. ↗
• → Flag POST requests to /shared/GetProductInfo with an empty body and X-Requested-With: XMLHttpRequest header — used by the Metasploit module to fingerprint vulnerable FortiLogger 4.4.2.2 instances before exploitation. ↗
• → Alert on HTTP responses from FortiLogger containing JSON key 'Version' equal to '4.4.2.2' — this is the version check used by the exploit module to confirm a vulnerable target. ↗
• → Monitor for ASP.NET responses (header containing 'ASP.NET') from /Assets/temp/hotspot/img/ paths — successful webshell execution will return HTTP 200 with ASP.NET headers. ↗
• → The exploit targets TCP port 5000 by default on Windows hosts running FortiLogger — scope network detection rules to this port. ↗

• · The Metasploit module uses a randomized WebKit form boundary (----WebKitFormBoundary + random alphanumeric), so the exact boundary string will vary per request. The Nuclei template uses a static boundary for PoC purposes only. ↗
• · The Metasploit module version check targets exactly '4.4.2.2', but the GitHub source notes the module has been tested on versions < 5.2.0 — detection should not be scoped only to 4.4.2.2. ↗
• · The uploaded payload is converted to an ASP webshell via Msf::Util::EXE.to_exe_asp — the file extension at the destination will be .asp, enabling server-side execution on IIS/ASP.NET backends. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434