U.S. CISA adds Fortinet FortiOS/FortiProxy and GitHub Action flaws to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-55591 | Unauthenticated Super-Admin Bypass in Fortinet FortiOS and FortiProxy CVE-2024-55591 is an authentication bypass (CWE-288) in the Node.js websocket module of Fortinet FortiOS and FortiProxy that lets a remote, unauthenticated attacker gain super-admin privileges via crafted websocket requests. It affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12, and is trivially triggerable from the network with no user interaction given network access to the management/websocket interface. Successful exploitation gives full super-admin control of the appliance, which attackers can use to pivot, create persistent access, and deploy ransomware. Any organization running the affected FortiOS or FortiProxy versions, especially with admin interfaces reachable from the internet, is affected. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-01-14, and multiple ransomware crews (reported as Gunra, SuperBlack, and Mora_001) are actively exploiting it. Do: Upgrade all affected systems beyond the vulnerable ranges — FortiOS later than 7.0.16 and FortiProxy later than 7.0.19 / 7.2.12 — following Fortinet's advisory, or apply the vendor's mitigations where upgrades are not possible (per CISA KEV instructions). Restrict access to the admin/websocket interface from the internet, and hunt for unauthorized super-admin accounts and suspicious websocket connections, since ransomware operators are actively exploiting this flaw. Verify device versions and audit logs for signs of compromise before and after patching. | 9.8 | 98% | KEV ransomware |
| large≈48,000+ internet-exposed Fortinet devices per public scans, out of an installed base in the hundreds of thousands | |
| CVE-2025-24472 | Authentication Bypass in Fortinet FortiOS and FortiProxy Grants Super-Admin Access CVE-2025-24472 is an authentication bypass (CWE-288) in the Fortinet Security Fabric of FortiOS and FortiProxy. A remote, unauthenticated attacker who already knows the serial numbers of both the upstream and downstream devices can send crafted CSF proxy requests to gain super-admin privileges on the downstream device; the attack only works where the Security Fabric is enabled, and the need for serial-number knowledge raises attack complexity. An attacker gains full super-admin control of the downstream Fortinet device, which can serve as a foothold for network-wide compromise. Organizations running affected FortiOS 7.0.x or FortiProxy 7.0.x/7.2.x builds with Security Fabric enabled are in scope. The flaw was added to CISA's KEV catalog on 2025-03-18 with known ransomware use, and multiple ransomware groups (including Gunra, SuperBlack, Mora_001 and Qilin operators) have been reported exploiting Fortinet firewall flaws in recent campaigns. Do: Upgrade FortiOS 7.0.x and FortiProxy 7.0.x/7.2.x deployments to the fixed releases listed in the Fortinet PSIRT advisory for CVE-2025-24472, and identify any devices where the Security Fabric is enabled and serial numbers of peer devices may be discoverable. As interim mitigation, restrict or disable Security Fabric (CSF) connectivity toward untrusted peers and limit access to the CSF proxy handling path. Because the flaw is KEV-listed with known ransomware use, federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use, and all defenders should review device logs for unexpected super-admin sessions and anomalous CSF proxy traffic. | 8.1 | 7% | KEV ransomware |
| masshundreds of thousands of deployed Fortinet appliances plausibly affected; the practical subset is those with Security Fabric enabled | |
| CVE-2025-30066 | Supply Chain Compromise of tj-actions/changed-files GitHub Action Exposes CI/CD Secrets CVE-2025-30066 is not a traditional code bug but a supply chain compromise: on 2025-03-14 and 2025-03-15, a threat actor modified the code behind every published tag (v1 through v45.0.7) of the widely used tj-actions/changed-files GitHub Action to point at commit 0e58ed8, which contained malicious 'updateFeatures' code. The flaw is triggered whenever a GitHub Actions workflow invokes any of these affected tags during the compromise window; the embedded code dumps the runner's environment variables into the workflow logs. Anyone able to read the actions logs — including public logs on public repositories — can discover repository secrets such as GitHub tokens, API keys, and cloud credentials, enabling account takeover and lateral movement. Public reporting indicates roughly 23,000 repositories/organizations were affected, with Coinbase initially targeted and 218 of its repositories' CI/CD secrets exposed; the attack was traced back to a compromised GitHub token. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-03-18, and both GitGuardian and StepSecurity published detection and incident analyses. Do: Update workflows from tj-actions/changed-files to v46 or later, or better, pin the action to a verified commit SHA rather than a mutable tag. Review all workflow run logs generated between 2025-03-14 and 2025-03-15 for dumped environment variables and rotate every credential that could have been exposed (GitHub PATs, cloud keys, deploy tokens), checking downstream systems and logs for abuse of those secrets. | 8.6 | 70% | KEV PoC ×2 |
| large≈23,000+ repositories and their organizations (public incident reporting counted over 23,000 affected repositories) |
Full article899 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiOS/FortiProxy and GitHub Action flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:
- CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
- CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
In February, Fortinet warned that threat actors were exploiting a new zero-day vulnerability, tracked as CVE-2025-24472 (CVSS score of 8.1), in FortiOS and FortiProxy to hijack Fortinet firewalls.
The vulnerability is an authentication bypass issue that could allow a remote attacker to gain super-admin privileges by making maliciously crafted CSF proxy requests.
“An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote attacker to gain super-admin privileges via crafted CSF proxy requests.” reads the advisory.
The vulnerability impacts FortiOS 7.0.0 through 7.0.16, FortiProxy 7.0.0 through 7.0.19, and FortiProxy 7.2.0 through 7.2.12. Fortinet fixed it in FortiOS 7.0.17 or above and FortiProxy 7.0.20/7.2.13 or above.
Fortinet added this vulnerability to an advisory related to the vulnerability CVE-2024-55591 disclosed in January. The flaw CVE-2024-55591 is an Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. The flaw could allow a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
“An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS and FortiProxy may allow a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module or via crafted CSF proxy requests.” reads the advisory. “Please note that reports show this is being exploited in the wild.”
Threat actors exploit the flaws to create rogue admin or local users, modify firewall policies, and access SSL VPNs to gain access to internal networks.
Last week, researchers at Forescout Research – Vedere Labs reported that between January and March, threat actors exploited two Fortinet vulnerabilities to deploy the SuperBlack ransomware. The experts attribute the attacks to a threat actor named “Mora_001” which using Russian-language artifacts and exhibiting a unique operational signature. The experts speculate Mora_001 could be linked to the LockBit ecosystem, reflecting the growing complexity of ransomware operations.
Mora_001 used the leaked LockBit builder to create encryptor, tracked by Forescout as SuperBlack ransomware, and removed any LockBit’s branding.
However Mora_001 is tracked as an independent threat actor, it exhibits consistent post-exploitation tactics, including identical usernames across victims, overlapping IPs, and rapid ransomware deployment within 48 hours. It is interesting to note that the ransom note shares a TOX ID with LockBit, suggesting a potential affiliation. However, its structured playbook and unique operational patterns distinguish it as a separate entity capable of independent intrusions.
CISA confirmed that the flaw CVE-2025-24472 is known to be used in ransomware campaigns.
The second flaw added to the catalog is CVE-2025-30066. StepSecurity researchers reported that threat actors compromised the GitHub Action tj-actions/changed-files, allowing the leak of secrets from repositories using the continuous integration and continuous delivery CI/CD workflow.
The tj-actions/changed-files GitHub Action is used in over 23,000 repositories, it automates workflows by detecting file changes in commits or pull requests, aiding testing, and automation. The CVE-2025-30066 (CVSS score: 8.6) was assigned to this supply chain attack.
“The tj-actions/changed-files GitHub Action, which is currently used in over 23,000 repositories, has been compromised. In this attack, the attackers modified the action’s code and retroactively updated multiple version tags to reference the malicious commit. The compromised Action prints CI/CD secrets in GitHub Actions build logs. If the workflow logs are publicly accessible (such as in public repositories), anyone could potentially read these logs and obtain exposed secrets.” states StepSecurity. “There is no evidence that the leaked secrets were exfiltrated to any remote network destination.”
StepSecurity discovered the supply chain attack on March 14, 2025, where attackers modified the tool to leak CI/CD secrets from workflow logs.
“StepSecurity Harden-Runner detected this issue through anomaly detection when an unexpected endpoint appeared in the network traffic. Based on our analysis, the incident started around 9:00 AM March 14th, 2025 Pacific Time (PT) / 4:00 PM March 14th, 2025 UTC.” continues StepSecurity. “Update March 14, 2025 11:00 PM UTC: Most versions of tj-actions/changed-files are compromised.”
On March 15, the company detected multiple public repositories that had leaked secrets in build logs, allowing anyone to steal these secrets.
The researchers noticed that compromised GitHub Action executes a malicious Python script that extracts CI/CD secrets from the Runner Worker process. Attackers retroactively altered multiple release tags to point to the same malicious commit, injecting an exploit that dumps memory and extracts sensitive data. The commit, falsely attributed to the renovate bot, downloads and executes a script from an external source, using memory forensics to locate and extract secrets.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by April 8, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/175583/security/u-s-cisa-adds-fortinet-fortios-fortiproxy-and-github-action-flaws-to-its-known-exploited-vulnerabilities-catalog.html