CVE-2021-3378

What it actually does

FortiLogger 4.4.2.2 allows unauthenticated network attackers to upload an arbitrary file by submitting it to the hotspot logo upload handler while claiming an image MIME type, such as Content-Type: image/png. The application fails to adequately validate the uploaded file type, content, extension, and execution context, allowing a server-side script to be placed under the web-accessible hotspot image directory and then accessed directly. Because the CVSS vector is network-accessible, low-complexity, unauthenticated, and requires no user interaction, successful exploitation can result in full compromise of confidentiality, integrity, and availability of the FortiLogger application and potentially the underlying host, depending on web server privileges.

Why it matters to the business

An exposed vulnerable FortiLogger instance can be taken over remotely without valid credentials. This can lead to theft of logs and configuration data, alteration or deletion of collected logging evidence, disruption of logging operations, and use of the server as a foothold for broader network intrusion. The very high EPSS score and weaponized exploit maturity indicate a high likelihood of exploitation in the wild even though the issue is not listed in CISA KEV.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable FortiLogger 4.4.2.2 instance. They send a crafted upload request to the vulnerable Config/SaveUploadedHotspotLogoFile endpoint, setting the Content-Type header to image/png while supplying content that is not a legitimate image, such as a server-executable script. Because the application trusts insufficient file metadata and stores the uploaded content under the web-accessible Assets/temp/hotspot/img/ location, the attacker can then browse to the uploaded ASP resource, commonly referenced as logohotspot.asp. If the server executes the uploaded file, the attacker gains the ability to run commands or interact with the application in the security context of the web service. From there, they may deploy a web shell, collect logs and credentials, modify application data, pivot to adjacent systems, or disrupt FortiLogger availability.

How to fix it

Upgrade FortiLogger to a vendor-supported version that is not affected by this arbitrary file upload flaw. No specific fixed version was provided in the input, so validate the remediation release directly against FortiLogger vendor advisories and release notes. If immediate upgrade is not possible, remove FortiLogger from direct internet exposure, restrict access to trusted administrative networks or VPN, block unauthenticated access to Config/SaveUploadedHotspotLogoFile, disable or tightly control hotspot logo upload functionality if feasible, and configure the web server so uploaded directories cannot execute ASP or other server-side scripts. Review and remove any unexpected files under Assets/temp/hotspot/img/ and related temporary upload directories before returning the service to production.

How to confirm the fix worked

Confirm the deployed FortiLogger version is no longer 4.4.2.2 and matches a vendor-supported fixed release. Verify that unauthenticated requests to Config/SaveUploadedHotspotLogoFile are rejected or require proper authorization. Attempt to upload a benign non-image test file with an image Content-Type header in a controlled manner and confirm it is rejected, renamed safely, stored outside the web root, or served only as inert content. Confirm that ASP or other server-side execution is disabled in upload directories. Inspect the web-accessible upload path and ensure unexpected scripts such as logohotspot.asp are absent. Review web server logs for historical POST requests to the vulnerable endpoint followed by GET requests to uploaded files.

Typical attack path

1. Scan for exposed FortiLogger instances and identify version 4.4.2.2 or behavior consistent with the vulnerable release.
2. Send an unauthenticated POST request to Config/SaveUploadedHotspotLogoFile with a spoofed image Content-Type header.
3. Upload a malicious server-side file disguised as a hotspot logo image.
4. Request the uploaded file from Assets/temp/hotspot/img/logohotspot.asp or a similar web-accessible path.
5. Use the executed script to run commands, upload additional tools, read or alter FortiLogger data, and establish persistence.
6. Clean up or rotate artifacts to reduce evidence, or use the compromised logging platform to impair detection.

How to detect it

Review HTTP access logs, reverse proxy logs, WAF logs, and FortiLogger application logs for POST requests to Config/SaveUploadedHotspotLogoFile, especially unauthenticated requests or requests using Content-Type: image/png followed shortly by GET requests to Assets/temp/hotspot/img/logohotspot.asp. Search the FortiLogger web root and temporary upload directories for unexpected ASP, script, executable, or recently modified files. On Windows/IIS hosts, examine IIS logs, Windows Security logs, PowerShell logs, process creation telemetry, and EDR records for web service worker processes spawning command interpreters or scripting utilities. Look for evidence of the web server process launching cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, rundll32.exe, or other living-off-the-land tools after requests to the upload path. Because the product stores logs, also check for log deletion, truncation, gaps, altered timestamps, disabled services, or unexpected configuration changes after suspicious upload activity.

• Config/SaveUploadedHotspotLogoFile
• Assets/temp/hotspot/img/logohotspot.asp
• /Config/SaveUploadedHotspotLogoFile
• /Assets/temp/hotspot/img/logohotspot.asp
• logohotspot.asp
• Content-Type: image/png
• POST /Config/SaveUploadedHotspotLogoFile
• GET /Assets/temp/hotspot/img/logohotspot.asp
• Assets/temp/hotspot/img/
• w3wp.exe cmd.exe
• w3wp.exe powershell.exe
• w3wp.exe cscript.exe
• w3wp.exe wscript.exe
• w3wp.exe certutil.exe
• w3wp.exe bitsadmin.exe

What your security team should do

• Treat exposed FortiLogger 4.4.2.2 systems as high priority due to unauthenticated remote exploitability, CVSS 9.8 severity, very high EPSS probability, and weaponized exploit maturity.
• Immediately inventory FortiLogger deployments and determine whether any are running version 4.4.2.2 or are externally reachable.
• Upgrade to a vendor-supported non-vulnerable release; if no reliable patch path is available, isolate or retire the affected instance.
• Restrict management and application access to trusted networks and block public access to the vulnerable upload endpoint.
• Hunt for prior exploitation using web server logs, FortiLogger application logs, filesystem artifacts, and process execution evidence around the upload directory.
• Remove suspicious uploaded files and perform host-level incident response if any executable content is found in Assets/temp/hotspot/img/ or related upload paths.
• Ensure upload directories are configured as non-executable and enforce server-side validation of file extension, MIME type, magic bytes, and storage location.
• Preserve logs and forensic images before cleanup if compromise is suspected, because the affected product is a logging platform and evidence integrity may be impacted.