FortiPAM Chrome Extension Vulnerability Enables Remote Traffic Proxying (CWE-287)

What Happened

Fortinet’s Privileged Access Agent (FortiPAM) Chrome Extension has a flaw that bypasses authentication checks. An attacker can inject malicious code into a user’s browser session and redirect traffic through servers controlled by the attacker when the user visits a compromised site.

Impact

Any user with the extension installed is at risk of having all HTTP and HTTPS requests proxied to an attacker. The vulnerability is remote, unauthenticated, and scores 9.1 on CVSS v3. It can lead to data exfiltration, credential theft, and man‑in‑the‑middle attacks.

Mitigation Steps

• Update the FortiPAM Chrome Extension to the latest version that removes the authentication bypass.
• If an update is unavailable, uninstall or disable the extension entirely.
• Block outbound connections from the browser to known malicious proxy IP ranges via firewall or proxy settings.
• Apply a browser policy that restricts extensions to a whitelist of approved extensions.

Detection & Monitoring

Monitor for unusual outbound traffic patterns from browsers, especially traffic that originates from the extension’s process. Use IDS/IPS signatures that flag proxy requests to unfamiliar domains and alert on HTTP CONNECT methods that bypass normal routing.