Fortinet patches pre-auth RCE, update your Fortigate firewalls ASAP! (CVE-2023-27997)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-27997 | Pre-Auth Heap Buffer Overflow RCE in Fortinet FortiOS/FortiProxy SSL-VPN CVE-2023-27997 is a heap-based buffer overflow (CWE-122, with associated out-of-bounds write CWE-787) in the SSL-VPN component of Fortinet FortiOS and FortiProxy, reachable by unauthenticated users. A remote attacker can trigger it with specially crafted requests to the SSL-VPN web interface, gaining the ability to execute arbitrary code or commands on the gateway. Full control of an edge VPN/firewall appliance enables credential theft, session hijacking, and pivoting into the protected network, which makes the bug attractive to ransomware operators. Any organization exposing the SSL-VPN portal on the affected FortiOS builds (7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below) or FortiProxy builds (7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and 1.1/1.2 all versions) is potentially exposed. The flaw is under active exploitation: CISA added it to the KEV on 2023-06-13 with known ransomware use, EPSS estimates an ~86% probability of exploitation within 30 days (100th percentile), and reporting indicates it was likely being exploited in the wild, with Fortinet also warning that some attackers retained access to FortiGate devices even after patching. Do: Apply Fortinet's updates to all SSL-VPN-enabled FortiOS and FortiProxy appliances as required by the CISA KEV listing, upgrading each affected branch beyond the listed versions (end-of-life FortiProxy 1.1/1.2 requires migration to a supported release); if SSL-VPN is not needed, disable the web portal or restrict it to trusted source addresses. After patching, hunt for signs of compromise and rotate credentials and VPN-related secrets, since Fortinet warned that some attackers retained access to FortiGate devices post-patching. | 9.8 | 86% | KEV ransomware |
| masson the order of several hundred thousand internet-exposed SSL-VPN endpoints (≈300k–500k per public scans) |
Full article497 words · extracted from helpnetsecurity.com · click to collapse
Fortinet has released several versions of FortiOS, the OS/firmware powering its Fortigate firewalls and other devices, without mentioning that they include a fix for CVE-2023-27997, a remote code execution (RCE) flaw that does not require the attacker to be logged in to exploit it.
The vulnerability has been fixed in FortiOS versions 7.2.5, 7.0.12, 6.4.13, 6.2.15 and, apparently also in v6.0.17 (even though Fortinet officially stopped supporting the 6.0 branch last year).
Enterprise admins are advised to upgrade Fortigate devices as soon as possible – if the vulnerability is not already being exploited by attackers, it’s likely that it will soon be.
About CVE-2023-27997
The exact nature of the vulnerability is currently (publicly) unknown. According to Olympe Cyberdefense, Fortinet will be releasing more details on June 13, 2023 (Tuesday).
They say that the vulnerability is critical, affects Fortigate firwall’s SSL VPN functionality, and may allow an attacker to “interfere via the VPN, even if MFA is activated.”
Lexfo security researcher Charles Fol, who along with colleague Dany Bach reported the flaw, says that CVE-2023-27997 allows RCE, is “reachable pre-authentication, on every SSL VPN appliance,” and that they will be releasing more details at a later time.
There is currently no mention of possible workarounds.
Patch quickly!
Unfortunately for enterprise defenders, threat actors can compare the newer versions of the OS with older ones to find what the patch does and, based on that information, develop a working exploit.
Vulnerabilities affecting Fortigate firewalls have been a popular target in the past.
Also, Fortinet has been known to push out critical fixes without mentioning vulnerabilities – whether actively exploited or not. Enterprise admins should therefore move fast and implement the patch as soon as possible.
If the available update doesn’t show up in the device’s dashboard, rebooting it may make it show up. If not, manual download and installation is advised.
UPDATE (June 13, 2023, 08:20 a.m. ET):
Fortinet has published a security advisory for CVE-2023-27997, describing it as a heap-based buffer overflow vulnerability in FortiOS and FortiProxy SSL-VPN that may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
In an accompanying blog post, the company said that the vulnerability “may have been exploited in a limited number of cases,” but does not offer more information.
Fortinet also pointed out that while they are not linking exploitation of this particular flaw to the Volt Typhoon threat actors (who have exploited FortiOS flaws in the past), they expect “all threat actors, including those behind the Volt Typhoon campaign, to continue to exploit unpatched vulnerabilities in widely used software and devices,” and advise IT admins to engage in “an aggressive patching campaign.”
Rapid7 says they also expect CVE-2023-27997 will be leveraged by attackers, but that “heap-based exploits are notoriously tricky, and it’s unlikely that we’ll see automated exploitation at scale.”
UPDATE (June 14, 2023, 03:40 a.m. ET):
The researchers who uncovered the vulnerability have shared technical details and a demo of its exploitation.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/06/11/cve-2023-27997/