Auth bypass bug in FortiOS, FortiProxy is exploited in the wild (CVE-2022-40684)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-40684 | Admin-Interface Auth Bypass in Fortinet FortiOS, FortiProxy & FortiSwitchManager Fortinet's FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability (CWE-288) that lets an unauthenticated remote attacker gain access to the administrative interface. It is triggered by sending specially crafted HTTP or HTTPS requests directly to the admin interface, with no credentials or exploit code required. By bypassing authentication, an attacker can perform administrative operations on the device, such as modifying configuration or creating privileged accounts. Any organization running the affected products is exposed, particularly where the management interface is reachable from the internet. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-10-11 with known ransomware use, and EPSS assigns it roughly a 100% probability of exploitation within 30 days, although no public PoC is known. Do: Upgrade FortiOS, FortiProxy, and FortiSwitchManager to the fixed releases identified in Fortinet's advisory per the KEV required action. As mitigation, restrict access to the admin interface (e.g., disable WAN-facing management and use local-in policies or allow-lists for management IPs). Review admin logs and device configuration for signs of unauthorized access, such as unexpected admin accounts, added SSH keys, or config changes. | 9.8 | 100% | KEV ransomware PoC ×2 |
| massHundreds of thousands of internet-exposed Fortinet admin interfaces (~300k+ exposed FortiGate/FortiProxy management interfaces observed in public scans around… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | horizon3.ai | nt of the breach. UPDATE (October 13, 2022, 05:35 a.m. ET): Horizon3.ai researchers have shared more IoCs defenders can search for, |
Full article433 words · extracted from helpnetsecurity.com · click to collapse
After privately warning customers last week that they need to patch or mitigate CVE-2022-40684, a critical vulnerability affecting FortiOS, FortiProxy, and FortiSwitchManager, Fortinet has finally confirmed that it “is aware of an instance where this vulnerability was exploited.”
But their advice to organizations to immediately check their systems for a specific indicator of compromise makes it sound like they believe more widespread attacks have happened or are happening.
About CVE-2022-40684
CVE-2022-40684 is an authentication bypass vulnerability on vulnerable devices’ administrative interface that can be triggered by sending a specially crafted HTTP(S) requests.
It affects:
- FortiOS versions: 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0
- FortiProxy versions: 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0
- FortiSwitchManager versions: 7.2.0, 7.0.0
Successful exploitation may allow attackers with access to the management interface to perform administrator operations and to, essentially, take control of the device.
The patch has already been reverse-engineered by security researchers:
I can confirm, CVE-2022-40684 is really simple to exploit and easy to weaponize.
is not only a "Auth bypass to some functions", this vulnerability causes a full device takeover!
— Carlos Vieira (lynx) (@carlos_crowsec) October 10, 2022
Hey @todb, we did not discover the original issue – we only reversed the patch. We'll credit the original researcher in our blog post when / if that information is made public.
— Zach Hanley (@hacks_zach) October 10, 2022
It seems likely that other attackers will soon get their hands on an exploit or create one themselves and start targeting exposed and vulnerable FortiGate firewalls and FortiProxy secure web gateways around the world. (FortiOS vulnerabilities are often exploited by attackers).
What should you do?
You should upgrade your Fortinet appliances to a firmware version with the fix:
- FortiOS version 7.2.2 or above, or version 7.0.7 or above
- FortiProxy version 7.2.1 or above, or 7.0.7 or above
- FortiSwitchManager version 7.2.1 or above
If that’s not possible, depending on the device, you should disable the HTTP/HTTPS administrative interface or limit IP addresses that can reach the administrative interface.
Finally, you should look for the following string in the device’s logs: user=”Local_Process_Access”. If you find it, your device has been compromised, and you should investigate the extent of the breach.
UPDATE (October 13, 2022, 05:35 a.m. ET):
Horizon3.ai researchers have shared more IoCs defenders can search for, as well as additional mitigation advice.
GreyNoise has created a tag page for the exploit registered by Fortinet, which is currently being lauched from one IP address.
UPDATE (October 14, 2022, 10:15 a.m. ET):
Horizon3.ai researchers have released a PoC exploit for CVE-2022-40684 and exploitation attempts are mounting.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/10/11/cve-2022-40684-exploited/