CVE-2023-42784
Published: 11 March 2025
Summary
CVE-2023-42784 is a medium-severity Improper Handling of Syntactically Invalid Structure (CWE-228) vulnerability in Fortinet Fortiweb. Its CVSS base score is 5.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the improper handling of syntactically invalid HTTP/S structures by enforcing validation of crafted requests to prevent unauthorized code execution.
Ensures timely identification, reporting, and patching of the specific flaw in affected FortiWeb versions as recommended in the vendor advisory.
Monitors and controls communications at external boundaries to filter or block crafted HTTP/S requests targeting the vulnerable FortiWeb component.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote code/command execution on a public-facing FortiWeb web application firewall via crafted HTTP/S requests with no authentication required, directly enabling exploitation of public-facing applications.
NVD Description
An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.
Deeper analysisAI
CVE-2023-42784 is an improper handling of syntactically invalid structures (CWE-228) vulnerability affecting Fortinet FortiWeb in versions 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10. The issue stems from inadequate validation of crafted HTTP/S requests, enabling attackers to execute unauthorized code or commands.
Remote attackers require no privileges or user interaction to exploit this over the network (AV:N/PR:N/UI:N), but it demands high attack complexity (AC:H) with unchanged scope (S:U). Successful exploitation yields low impacts across confidentiality, integrity, and availability (C:L/I:L/A:L), for an overall CVSS v3.1 score of 5.6.
Mitigation details, including patches, are outlined in the Fortinet PSIRT advisory FG-IR-23-115 at https://fortiguard.fortinet.com/psirt/FG-IR-23-115.
Details
- CWE(s)