FORTINET Security Advisory
Published Date: Not specified
Advisory Summary
🔎 🧩 SSRF in FortiSIEM GUI (CWE-918) — Risk to internal reachability
FortiSIEM GUI contains a Server-Side Request Forgery (SSRF) vulnerability (CVSSv3 3.4) that may allow an authenticated attacker to trigger the FortiSIEM server to make HTTP requests using specially crafted requests.
- Internal pivoting potential: SSRF can sometimes reach internal services (metadata endpoints, management interfaces, internal web apps) depending on network egress rules and URL handling.
- Auth already required: The attacker must be authenticated, which reduces exposure, but does not eliminate impact for exposed admin/UI roles.
- Threat amplification: In SIEM deployments, attackers may leverage this to facilitate broader compromise or reconnaissance through allowed internal paths.
- Confirm whether your FortiSIEM GUI is internet-accessible or reachable from less-trusted networks.
- Review admin-user provisioning and MFA enforcement (since exploitation requires authenticated access).
- Check egress restrictions from the FortiSIEM host (firewall/segmentation) to reduce reachable internal targets if SSRF is exploited.
- Look for unusual outbound HTTP activity originating from the FortiSIEM server around admin/UI sessions.
- Apply the PSIRT fix/upgrade associated with the advisory as soon as available in your maintenance window.
- Harden access to the GUI: restrict source IPs, enforce MFA, and minimize privileged accounts.
- Monitor and block: add detections for abnormal URL patterns and unexpected outbound requests from the FortiSIEM server.
- CWE-918 — SSRF
- FortiSIEM GUI SSRF (PSIRT: FG-IR-26-159)
Reference: Vendor Advisory