- Ubungozi obubalulekile be-CVE-2026-21643 ku-FortiClientEMS 7.4.4 buvumela ukufakwa kwe-SQL kanye nokusetshenziswa kwekhodi ekude okungenzeka ngaphandle kokuqinisekiswa.
- Ubuthakathaka buhlobene nokuphathwa okungaphephile kwesihloko se-HTTP Site ku-middleware, okungasetshenziswa nge-public endpoint /api/v1/init_consts.
- Ukuxhashazwa kungaholela ekwehlisweni okuphelele kwedatha yokuphatha, ukwebiwa kweziqinisekiso, kanye nokuguqulwa kwezinqubomgomo ezisatshalaliswa kuzo zonke iziphetho.
- Ukunciphisa lokhu kuhilela ukuthuthukela ku-FortiClientEMS 7.4.5 noma ngaphezulu, ukukhubaza imodi yokuqasha abaningi uma ingenakushintshwa ngokushesha, kanye nokukhawulela ukufinyelela kukhonsoli yokuphatha.
La ukuphepha kwamapulatifomu okuphatha ama-endpoint Ukuphepha sekuyinkinga ebalulekile ezinkampanini eziningi, futhi isibonelo sakamuva esicacile yi-Fortinet kanye nesisombululo sayo se-FortiClient Endpoint Management Server (EMS). Ezinyangeni zamuva nje, kutholakale ukuthi kukhona ubuthakathaka obukhulu bokufaka i-SQL obuthinta uhlobo oluthile lomkhiqizo, okudala umsindo omkhulu emphakathini wezokuphepha kwe-cyber.
Kulesi sihloko sizochaza ngokuthula ukuthi kwenzekani nge- Ukufakwa kwe-SQL Okubalulekile eFortinetIsebenza kanjani i-CVE-2026-21643 yokuba sengozini, imuphi umthelela wangempela enawo ezinhlanganweni, isetshenziswa kanjani ngokoqobo, futhi ngaphezu kwakho konke, yiziphi izinyathelo eziphuthumayo nezesikhathi esimaphakathi okufanele uzisebenzise uma uphatha ingqalasizinda esekelwe ku-FortiClientEMS noma imikhiqizo efanayo?
Umongo wobuthakathaka be-CVE-2026-21643 ku-FortiClientEMS
Ukuba sengozini I-CVE-2026-21643 Kuhlukaniswe njengezinto ezibucayiNjengoba amaphuzu e-CVSS esukela ku-9.1 kuya ku-9.8 ngokusho kwemithombo ehlukahlukene, okwenza kube sezingeni eliphezulu kakhulu lobunzima, ubuthakathaka buse-FortiClient Endpoint Management Server (EMS), ipulatifomu esetshenziswa izinkampani ukufaka nokuphatha ama-ejenti e-FortiClient kumadivayisi abo abasebenzisi.
Ngokukhethekile, inkinga iyathinta Inguqulo ye-FortiClientEMS 7.4.4 yegatsha 7.4 uma imodi yokuqasha abaningi (umsebenzi "weSayithi") ivuliwe. Izinguqulo 8.0 no-7.2, kanye nezimo ze-FortiEMS Cloud, azithintwa yilesi siphazamiso, ngakho-ke i-Fortinet igxile kuzo zonke izincomo zokunciphisa ezindaweni ezisasebenzisa inguqulo 7.4.4 endaweni.
Lokhu kufakwa kwe-SQL kwenzeka nge- ukungathathi hlangothi okungalungile kwezinto ezikhethekile ezitatimendeni ze-SQL, ihlukaniswe ngaphansi kwe-CWE-89. Empeleni, ivumela umhlaseli okude ongagunyaziwe ukuthi athumele izicelo ze-HTTP ezenziwe ngokukhethekile futhi enze iseva ukuthi ikhiphe imiyalo ye-SQL engahleliwe, engaphetha ngokusetshenziswa kwekhodi ekude (i-RCE) ngamalungelo omsebenzisi wedathabheyisi.
Izeluleko zokuphepha zeFortinet zibonisa ukuthi ubuthakathaka butholakala ku- Ingxenye ye-FortiClientEMS GUIOkusho ukuthi, isikhombikubona esisekelwe kuwebhu esisetshenziswa ngabaphathi ukuphatha nokuqapha ama-endpoints. Lokhu kusho ukuthi noma yisiphi isimo esinesikhombikubona esitholakala ku-inthanethi siba yisisulu esikhangayo kakhulu sabahlaseli.
Ukuthi ukujova kwe-SQL okubaluleke kangakanani kuvela eFortinet
Umsuka wenkinga uhlobene ne- Ukulungiswa kabusha kwe-middleware enkulu ku-FortiClientEMS 7.4.4Phakathi nalokhu kubuyekezwa kwekhodi, abathuthukisi bashintshe indlela uhlelo lokusebenza oluphatha ngayo ukuxhumana nedathabheyisi ye-PostgreSQL kanye nomzila wokuqasha, ngengozi bethula iphutha kufayela lokuxhumana.
Kule ndlela entsha yokucabanga, iseva idlula ngqo Isihloko se-HTTP Site ukubonisana search_path nguPostgreSQLUmgomo bekuwukukhetha i-schema ehambisana nomqashi ngamunye ngokusekelwe kulesi sihloko, kodwa inkinga enkulu ukuthi i-middleware ayenzi ukuqinisekiswa okufanele noma ukuhlanza lelo nani.
Ngenxa yalokho, umhlaseli angakwazi phula ifomethi yentambo ehlosiwe bese ufaka umthwalo wabo wokukhokha ononya esitatimendeni se-SQL, kufaka imiyalo engahleliwe ezosetshenziswa yi-database ngamalungelo aphezulu umsebenzisi wesevisi awalungiselele ngaphakathi komshini we-Fortinet virtual.
Ingozi iyanda kakhulu ngoba lokhu I-middleware esengozini isebenza ngaphambi kwanoma yikuphi ukuhlolwa kokuqinisekisaNgamanye amazwi, asikho isidingo sokungena ngemvume noma sokuba neziqinisekiso: vele uthumele isicelo se-HTTPS esishintshiwe ngesihloko seSayithi esiguquliwe ukuze uzame ukusizakala ngobuthaka.
Le phethini ifanelana kahle nesimo se-CVSS 3.1 se- AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hlapho ukuhlaselwa kufika ngenethiwekhi, kunobunzima obuphansi, akudingi amalungelo angaphambilini noma ukusebenzisana komsebenzisi, futhi kulimaza ngokuphelele ubumfihlo, ubuqotho, kanye nokutholakala kohlelo oluthintekile.
Ivektha yokuhlasela: i-endpoint /api/v1/init_consts kanye nesihloko sesayithi
Abacwaningi bezokuphepha, njengethimba likaBishop Fox, bachaze ukuthi i-vector yokuhlasela ewusizo kakhulu itholakala ekugcineni. kufinyeleleka esidlangalaleni /api/v1/init_consts, umzila we-FortiClientEMS API osetshenziswa ngesikhathi sokuqaliswa kwesixhumi esibonakalayo.
Abahlaseli bangasebenzisa leli phuzu lokuqala ukuze Hlola ukuthi imodi yokuqasha abaningi ivuliwe yiniUma bethola ukuthi ukusebenza kweSayithi kuvuliwe, bayaqhubeka nokufaka imithwalo ye-SQL ngesihloko se-HTTP. Site, besebenzisa iqiniso lokuthi inani lidluliselwa ngaphandle kokuhlanza umusho search_path.
Le ndawo yokugcina inezinkinga eziningana zokuklama: ngakolunye uhlangothi, Ayinazo izindlela zokunciphisa amazinga Ayinazo izindlela ezithile zokuzivikela ekuhlaselweni ngamandla amakhulu; ngaphezu kwalokho, ibuyisela ngqo imiyalezo yamaphutha ekhiqizwe yi-PostgreSQL emzimbeni wempendulo. Lokhu kwenza impilo ibe lula kakhulu kumhlaseli.
Ngokwamukela la maphutha ngokusobala kangaka, umenzi wobubi angenza amasu okulwa ukukhipha okusekelwe emaphutheni esicelweni esisodwangaphandle kokusebenzisa imijovo ehamba kancane kakhulu, esekelwe esikhathini. Lokhu kuvumela ukubalwa okusheshayo kakhulu kwamathebula, amakholomu, kanye nedatha ebucayi.
Uma ukuxhashazwa kuphumelele, umhlaseli ufinyelela esimweni sokuthi ukuzibophezela okugcwele kwedatha yokuphathwa kwe-endpointNjengoba umsebenzisi wesizindalwazi esebenzisa amalungelo e-PostgreSQL superuser, awakwazi nje kuphela ukukhipha ulwazi, kodwa futhi aqhubekele ekusebenziseni ikhodi ekude ohlelweni lokusebenza oluyisisekelo.
Umthelela wangempela enhlanganweni kanye naseziphethweni zokugcina
Umthelela walobu buthakathaka udlulela ngalé kokuvuza kwedatha okulula. Ikhono lokwenza i-SQL engahleliwe kusizindalwazi se-FortiClientEMS livumela abahlaseli ukweba amaphasiwedi omlawuli, izitifiketi zedijithali kanye uhlu oluphelele lwamadivayisi ixhunywe epulatifomu.
Ngalelo zinga lokufinyelela, umuntu osongelayo angakwazi shintsha izinqubomgomo zokuphepha bese usabalalisa ukucushwa okunonya kuzo zonke izindawo zokugcina eziphethwe. Lokhu kuvula umnyango wezimo eziyinkimbinkimbi lapho ama-ejenti ezokuphepha enhlangano eba yi-vector yokuhlasela kunethiwekhi yangaphakathi.
Ngaphezu kwalokho, ukuyekethisa kwedatha yokuphatha nakho kuthinta ubumfihlo bedatha egciniwe (isibonelo, ulwazi mayelana nabasebenzisi, imishini, izinqubomgomo kanye nezitifiketi), ubuqotho (ukuguqulwa kwemithetho, amathempulethi kanye nezabelo) kanye nokutholakala (ukususwa kwedatha okungenzeka noma ukubhujiswa kweseva yokuphatha).
Lolu songo luhambisana ne- umkhuba ovame kakhulu wokuhlaselwa kwamadivayisi asemaphethelweni kanye nezinhlelo zokuphatha, ezithandwa kakhulu yizigebengu ze-inthanethi ngoba zisebenza njengabagxilisi bolwazi futhi zilawula inqwaba yama-endpoints.
Ngenxa yazo zonke izizathu ezingenhla, i-Fortinet ibeke lobu buthakathaka njengobubucayi, futhi izinhlangano zokuphepha nezinkampani zincoma ukuphatha noma yisiphi isibonelo se-FortiClientEMS 7.4.4 esiveziwe njengempahla eyingozi enkulu kuze kube yilapho kufakazelwa ngenye indlela.
Indawo yokuxhashazwa esebenzayo kanye nendawo yokuchayeka
Nakuba eminye imibiko yokuqala ibonise ukuthi akukho ukuxhashazwa okusebenzayo okutholiwe, Abacwaningi benkampani iDefused baqinisekisile ukuhlaselwa kwangempela besebenzisa i-CVE-2026-21643 ezinsukwini ezine nje ngaphambi kokuba isinqumo sikhishwe emphakathini.
Idatha eqoqwe yizinhlangano ezifana ne-Shadowserver ikhombisa ukuthi Cishe izimo ezingu-2.000 ze-FortiClientEMS zavezwa ngqo kwi-inthanethi ngesikhathi sokuqapha. I-United States yayihola izibalo ngamaseva angaba ngu-756 asengozini, kulandele iYurophu enamaseva angaphezu kuka-680. I-Shodan iphinde yathola ama-interface ewebhu e-FortiClientEMS angaphezu kuka-1.000 afinyeleleka emphakathini, amaningi awo angakalungiswa.
Ukubhaliswa okusemthethweni kwe-NIST kwe-CVE-2026-21643 kusekela lobu bunzima obukhulu, okubonisa i-vector I-AV:N/AC:L/PR:N/UI:N enomthelela omkhulu ku-C, I kanye no-ALokhu kusho ukuthi noma iyiphi iseva ye-FortiClientEMS 7.4.4 ene-interface yewebhu evulekele i-inthanethi ingathathwa ngokuphelele ngaphandle kokuthi umhlaseli adinge iziqinisekiso noma kudingeke ukuthi akholise noma yimuphi umsebenzisi ukuthi achofoze noma yini.
I-Defused ibike lezi zigigaba ngoMashi 28, yaphawula nokuthi, naphezu kwalokhu, ubuthakathaka babungakafakwa ohlwini lwekhathalogi ye-CISA ye-KEV (Known Exploited Vulnerability) noma kolunye uhlu lomphakathi lwamaphutha asetshenziswa ngenkuthalo, into evame ukwenzeka kulezi zikhathi zokuqala zokuxhashazwa.
Ngakolunye uhlangothi, iFortinet yayinayo I-patch yakhululwa ngoFebhuwari. ngenguqulo 7.4.5, ecacisa iphethini ephindaphindayo kwezokuphepha kwe-cyber: kunesikhala sesikhathi esibalulekile phakathi kokutholakala kokulungiswa kanye nokusetshenziswa kwangempela ekukhiqizweni, isikhathi lapho abahlaseli basebenzisa khona ithuba lokwehlisa izinhlelo ezingakabuyekezwa.
Izinkomba zokuyekethisa kanye nezimpawu zokuhlasela
Kubaphathi abaphethe i-FortiClientEMS, kubalulekile ukuqonda izinkomba ezishiywe ngumzamo wokuxhashazwa okungenzeka. Phakathi kweziyinhloko izinkomba zokuzibophezela (IoC) okulandelayo:
Okokuqala, baqokomisa izikhathi zokuphendula ezinde ngokungavamile, kusukela kumasekhondi angu-5 kuya kwangu-20, emaphethelweni /api/v1/auth/signin o /api/v1/init_consts, njengoba kubonakala ku-access log ye-Apache noma enye iseva yewebhu engaphambili.
Futhi kuyisibonakaliso sesixwayiso okufanele usibone Izimpendulo ze-HTTP 500 eziphindaphindiwe ezivela ekhelini elifanayo le-IP ngokumelene nephuzu lokugcina /api/v1/init_constsLe ndlela ingabonisa ukuthi umhlaseli ulungisa imithwalo yakhe yokufakwa kwe-SQL ngokuzama nokuphutha aze athole esebenza futhi engadali amaphutha.
Ngaphezu kwalokho, kufanelekile ukubheka kuma-log amaphutha e-PostgreSQL. imibuzo search_path ngezingcaphuno ezilodwa, ama-semicolon, noma amagama angukhiye e-SQL njengoba SELECT, INSERT o UPDATE ngaphandle komongo olindelekile. Lolu hlobo lomkhondo luvame ukukhomba ngqo emzamweni wokushintsha isihloko seSayithi.
Njengendlela yokuphendula, noma iyiphi iseva ye-FortiClientEMS 7.4.4 evezwe kwi-inthanethi ngaphandle kokubuyekezwa okufanele kufanele iphathwe njenge okungenzeka kube sengoziniLokhu kuhilela ukuyihlukanisa nenethiwekhi, ukwenza ukuhlaziywa okuningiliziwe kwe-forensic (isizindalwazi, uhlelo lokusebenza kanye nama-log) kanye nokuhlela ukwakhiwa kabusha okulawulwayo kwemvelo uma kutholakala ubufakazi bokungena ngaphakathi.
Ukunciphisa ngokushesha kanye nesixazululo esisemthethweni esivela eFortinet
Indlela eyinhloko yokunciphisa icacile: Thuthukisa i-FortiClientEMS 7.4.4 ibe yinguqulo 7.4.5 noma ngaphezulu ngokushesha okukhulu. I-Fortinet ilungise ubuthakathaka ngokufaka esikhundleni sokuhlanganiswa kwezintambo embuzweni ngokuphathwa kahle kwezihlonzi ezibekwe ngamapharamitha kanye nokuphunyuka ngokuphephile kokufaka okuvela kusihloko seSayithi.
Izinguqulo 8.0 no-7.2, kanye ne-FortiEMS Cloud, akukho zenzo ezengeziwe ezidingekayoNjengoba bengathinteki yilobu buthakathaka obuthile, kusengumqondo omuhle ukubuyekeza ukuchayeka kwabo kwi-inthanethi kanye nokulungiswa kokufinyelela, ngoba indawo yokuhlasela yama-consoles okuphatha kufanele ibe ncane ngaso sonke isikhathi.
Kulawo maqembu, ngenxa yezizathu zokusebenza, angakwazi ukusebenzisa i-patch ngokushesha, abanye abacwaningi batusa ukunciphisa okwesikhashana: khubaza ukusebenza kwe-“Sites” yabaqashi abaningiLesi senzo sivimbela indlela yekhodi esengozini exhunywe kusihloko seSayithi ukuthi ingasebenzi, okunciphisa kakhulu izinketho zokuxhashazwa.
Ngokufanayo, kubalulekile Vimbela ukufinyelela kuwebhu ku-interface yokuphatha i-EMS kumanethiwekhi angaphakathi athembekile kuphelaOkungcono kakhulu, ikhonsoli kufanele ibekwe ngemuva kwe-VPN noma indlela yokufinyelela engenalo ithemba, futhi ingalokothi ishiywe ivuliwe ngqo kwi-inthanethi ngaphandle kwasezimweni ezingavamile kakhulu nezivikelwe kahle.
Njengokwengeza, kuyalulekwa ukuthi kubuyekezwe futhi kuqiniswe imithetho ye-firewall kanye nanoma iyiphi i-WAF esinayo phambi kwe-FortiClientEMSngokusebenzisa izihlungi ezivimba amaphethini ajwayelekile okujova e-SQL kuma-header e-HTTP, ikakhulukazi ku-Site header, nangokuqapha ngokucophelela noma yiziphi izicelo ze-API ezingavamile.
Imikhuba emihle yokuphepha ngale kwe-patch
Ngaphandle kokusebenzisa i-patch kanye nokunciphisa okuthile, lesi sigameko senza kucace ukuthi Ukuphathwa kobungozi kufanele kube inqubo eqhubekayo Futhi hhayi nje ukusabela okukodwa nje kweseluleko somkhiqizi. Izinhlangano ezithembele kumapulatifomu okuphatha ama-endpoint kanye nezixazululo zokuphepha kwenethiwekhi kufanele ziqinise isu lazo ezicini eziningana.
Ngakolunye uhlangothi, kubalulekile ukuba ne- uhlu olubuyekeziwe lwezimpahla nezinguquloukuze uma kushicilelwa i-CVE ebalulekile, kube nokwenzeka ukuhlonza ngemizuzu ukuthi yiziphi izinhlelo ezisengozini futhi kubekwe phambili ukubuyekezwa kwazo ngokuya ngezinga lokuchayeka kanye nokubucayi.
Ngakolunye uhlangothi, kufanelekile ukubheja ukuhlolwa kokungena okuvamile kanye nokubuyekezwa kwezakhiwo lokho akuqinisekisi nje kuphela ukuqina komkhiqizo ngokwawo, kodwa futhi nendlela osetshenziswa ngayo: ukuhlukaniswa kwenethiwekhi, ukuhlukaniswa kwezinhlelo zokuphatha, imikhawulo yokufinyelela, ukuqapha amalogi okuphakathi, kanye nokutholakala kokuziphatha okungavamile.
Ngokuphathelene nentuthuko, leli cala liphinde libonise ukubaluleka kokuthi Sebenzisa izindlela zokuthuthukisa eziphephile kanye nokuhlolwa kokuhlehla Noma nini lapho kwenziwa ukuvuselelwa okujulile kwe-middleware noma izingxenye ezibalulekile, ukuthuthukiswa kokusebenza noma kokukhula akukwazi ukuhambisana nesinyathelo sokubuyela emuva ezindleleni eziyisisekelo ezifana nokuhlanza okufakwayo.
Izinkampani ezigxile ekuphepheni kwe-inthanethi kanye nokuthuthukiswa okuphephile zinikeza izinsizakalo ku Ukuhlolwa kwekhodi, ukuhlolwa kokungena, kanye nokubonisana Lawa mathuluzi aklanyelwe ngqo ukuthola lawa ma-vector ngaphambi kokuba afinyelele ekukhiqizweni. Ezindaweni ezihlanganisa ingqalasizinda yasendaweni, amafu, namadivayisi asemaphethelweni, ukuthembela kochwepheshe bangaphandle kuvame ukwenza umehluko omkhulu.
Okokugcina, ezingeni likahulumeni kanye nelebhizinisi, kuyasiza kakhulu ukuba amadeshibhodi kanye nobuhlakani bebhizinisi Lawa mathuluzi avumela ukubona isimo sobuthakathaka, ukuvezwa kwezixhumanisi zokuphatha, kanye nomthelela ongaba khona wokwehluleka okukhulu ezinqubweni zenhlangano. Le ndlela yenza kube lula ukubeka phambili ukutshalwa kwezimali kanye nokuthethelela izinyathelo zokuvimbela, nakuba zingase zibonakale zibiza kakhulu ekuqaleni, ekugcineni zisindise izinkinga eziningi esikhathini esiphakathi.
Ukuhlanganiswa kwephutha elikhulu lomklamo, indawo enkulu yobuthakathaka, kanye nokubambezeleka okuvamile kokulungiswa kwenza i-CVE-2026-21643 ibe yisibonelo esihle sokuthi kungani ukuphepha kwekhonsoli yokuphatha kungafanele kuthathwe kancane. Noma iyiphi inhlangano esebenzisa i-FortiClientEMS noma izixazululo ezifanayo kufanele ithathe lesi sigameko njengesixwayiso. Buyekeza ukuma kwakho kokuphepha, usheshise imijikelezo yakho yokubuyekeza, futhi uqinise ukuzivikela ezisekelweni zakho zokuphatha ngaphambi kokuba olunye usuku olungenalutho noma umjovo omusha we-SQL uzibuyisele ezintanjeni.
