FORTINET Security Advisory
Published Date: Not specified
Advisory Summary
🔶 Improper Authentication of FortiPAM Server — What’s New?
Fortinet has disclosed a CWE-287 (Improper Authentication) issue tied to the Fortinet Privileged Access Agent (PAM) Chrome Extension. With a CVSSv3 score of 9.1, the vulnerability could let an unauthenticated remote attacker proxy a user’s browser traffic through attacker-controlled servers if the user visits a malicious website.
- The weakness is in the authentication enforcement model of the PAM browser extension flow.
- An attacker leverages user interaction (malicious site visit).
- Result: browser traffic interception/proxying, which can enable credential theft, session abuse, or exposure of sensitive internal resources—especially dangerous for privileged environments.
- Privilege escalation by context: PAM-related tooling often has access pathways that are more trusted than standard browsing.
- Traffic visibility loss: routing browser traffic through attacker infrastructure can undermine monitoring and increase dwell time for follow-on attacks.
- User-targeted compromise: successful phishing chains become more damaging when browser extensions are involved.
🛡️ Recommended Actions (Actionable Checklist)
1. Apply the PSIRT fix immediately for the affected FortiPAM/PAM extension components (per the vendor guidance in the advisory).
2. Validate extension versions across endpoints and managed browser profiles; ensure only patched builds are deployed.
3. Harden against malicious browsing: strengthen web filtering, block known malicious domains/URLs, and enforce browser security controls where possible.
4. Review suspicious sessions and proxy indicators around the exposure window (e.g., unusual outbound destinations from user systems, abnormal session behavior).
5. Use compensating controls if patching is delayed: consider temporarily restricting or disabling the extension for high-risk groups until mitigations are in place.
đź“Ś
-287 #
Reference: Vendor Advisory