National CSIRT-CY | National Computer Security Incident Response Team of Cyprus

Authentication bypass in Node.js websocket module

The Digital Security Authority (DSA) wants to bring to your attention an Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16, FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allowing a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.