CVE-2022-39952

What it actually does

CVE-2022-39952 is an unauthenticated path traversal / arbitrary file write vulnerability in Fortinet FortiNAC. A specially crafted HTTP request can cause FortiNAC to process attacker-controlled file paths, allowing files to be written outside the intended directory. Because FortiNAC processes the uploaded content in a privileged application context, an attacker can place executable content, scheduled tasks, web shells, or other payloads on the appliance and achieve remote command execution. The vulnerability is network-accessible, requires no credentials or user interaction, and has full confidentiality, integrity, and availability impact.

Why it matters to the business

A compromised FortiNAC appliance can give an attacker a foothold in network access control infrastructure, potentially allowing them to disrupt device onboarding, interfere with access enforcement, pivot into internal networks, steal configuration or credential material, and impair network availability. The CVSS score is critical and the EPSS score is extremely high, with public weaponized exploitation available, so internet-exposed or broadly reachable FortiNAC systems should be treated as high-priority remediation targets even though this vulnerability is not currently listed in CISA KEV.

How an attack unfolds

An attacker identifies a reachable FortiNAC instance and sends a crafted unauthenticated HTTP request to the vulnerable file upload / key upload functionality. The request contains archive or file content with path traversal sequences that cause FortiNAC to write attacker-controlled files outside the expected upload location. The attacker commonly writes a web shell, cron entry, startup script, or other executable payload to a sensitive location on the appliance. Once the file is placed, the attacker triggers execution directly through HTTP, waits for a scheduled task to run, or uses the written payload to open a reverse shell. After code execution, the attacker may enumerate FortiNAC configuration, dump credentials or tokens, alter network access policies, deploy persistence, erase evidence, or pivot toward managed network segments.

How to fix it

Upgrade FortiNAC to a fixed release immediately. Fortinet guidance for this issue directed customers to upgrade affected 9.x branches to FortiNAC 9.4.1 or later, 9.2.6 or later, or 9.1.8 or later; older affected 8.x releases should be upgraded to a supported fixed branch. If immediate upgrade is not possible, restrict access to the FortiNAC administrative and web interfaces to trusted management networks or VPN-only access, block unauthenticated access from untrusted networks, and monitor for exploitation attempts. Because exploitation can result in arbitrary file placement and command execution, systems suspected of compromise should be investigated before being returned to service; patching alone does not remove attacker-created files, credentials, or persistence.

How to confirm the fix worked

Confirm the FortiNAC version is no longer in any affected range: 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, or 8.3.7. Verify that FortiNAC is running a fixed supported release such as 9.4.1+, 9.2.6+, or 9.1.8+ where applicable. Validate externally that FortiNAC web interfaces are not reachable from untrusted networks unless explicitly required. Review web server logs after patching to ensure requests to vulnerable upload endpoints are rejected or unavailable. Perform file integrity checks on web roots, cron directories, startup locations, and application directories to ensure no unauthorized files remain.

Typical attack path

1. Scan for Fortinet FortiNAC appliances exposed to the internet or reachable from compromised internal systems.
2. Confirm the appliance exposes vulnerable FortiNAC web functionality associated with configuration or key upload handling.
3. Send a crafted unauthenticated HTTP request containing attacker-controlled file paths or traversal sequences.
4. Write a payload outside the intended directory, such as a web shell, cron file, script, or executable artifact.
5. Trigger the payload or wait for the appliance to execute it.
6. Run commands on the FortiNAC appliance with the privileges of the vulnerable service or resulting execution context.
7. Collect configuration data, credentials, certificates, logs, and network access control information.
8. Establish persistence, remove evidence, disrupt NAC operations, or pivot to adjacent systems.

How to detect it

Look for evidence of unauthenticated requests to FortiNAC configuration/key upload functionality followed by unexpected file creation or command execution. Review FortiNAC web access logs, reverse proxy logs, WAF logs, application logs, system authentication logs, cron logs, shell history, process accounting, and file modification timestamps. Focus on HTTP POST requests to configuration wizard or key upload paths, requests containing traversal patterns, multipart file uploads from unusual IP addresses, and HTTP requests for newly created JSP or script files. On the appliance, inspect web roots, application directories, /tmp, /var/tmp, /etc/cron*, init/systemd locations, and user home directories for recently modified or unknown files. Investigate suspicious child processes spawned by web or Java/Tomcat services, such as shell interpreters, curl, wget, nc, python, perl, bash, sh, or reverse-shell activity. Correlate suspicious web requests with new outbound connections from the appliance, especially to unfamiliar external IPs or high-numbered ports. Because public exploits commonly use path traversal to create files, absence of a known web shell name does not rule out compromise; prioritize behavioral indicators such as unexpected file writes and command execution from the web application context.

• /configWizard/keyUpload.jsp
• POST /configWizard/keyUpload.jsp
• keyUpload.jsp
• ../
• ..%2f
• ..%2F
• %2e%2e%2f
• %2e%2e/
• multipart/form-data
• Content-Disposition: form-data; name="key"
• /etc/cron.d/
• /etc/crontab
• /var/spool/cron/
• /tmp/
• /var/tmp/
• /bin/bash -i
• /dev/tcp/
• bash -c
• sh -c
• curl http
• wget http
• nc -e
• ncat -e
• .jsp
• cmd=

What your security team should do

• Treat this as an urgent critical RCE exposure because exploitation is weaponized and the EPSS score is extremely high.
• Inventory all FortiNAC appliances, including internal-only management systems, lab appliances, and disaster recovery instances.
• Upgrade affected systems to a fixed supported FortiNAC release, prioritizing internet-facing or broadly reachable appliances first.
• Temporarily restrict FortiNAC web and administrative access to trusted management networks until upgrades and compromise checks are complete.
• Hunt for exploitation before and after patching by reviewing HTTP access logs, application logs, filesystem changes, cron entries, and suspicious processes.
• If exploitation is suspected, preserve logs and disk artifacts, rotate credentials and secrets stored on or used by FortiNAC, and assess downstream network access policy integrity.
• Deploy SIEM detections for requests to vulnerable upload paths, suspicious archive uploads, traversal sequences, and unexpected files written to web-accessible or scheduled-execution directories.
• Confirm backups are available and clean before restoring or rebuilding a compromised appliance.