Cring ransomware deployed targeting unpatched Fortinet VPN devices
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-13379 | Unauthenticated Path Traversal in Fortinet FortiOS SSL VPN CVE-2018-13379 is a path traversal flaw (CWE-22) in the Fortinet FortiOS SSL VPN web portal that allows an unauthenticated attacker to download FortiOS system files via specially crafted HTTP resource requests. By traversing directories through crafted requests to the exposed web portal, the attacker can retrieve sensitive files, a technique publicly documented as yielding the SSL VPN session file containing usernames and passwords in plaintext. Any organization running the SSL VPN web portal on a FortiGate appliance is affected, and risk is highest where the portal is directly reachable from the internet. The flaw is confirmed in the wild: it was added to the CISA KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public PoC is listed in the provided data, but credential theft tied to this bug has been widely reused by threat actors. Do: Apply the patched FortiOS release per Fortinet's vendor advisory immediately, as this is a CISA KEV required action; if the fixed version is not known from this data, follow Fortinet's FG-IR-18-384 advisory for the correct upgrade path. Rotate SSL VPN credentials and review VPN access logs for path-traversal requests, since successful exploitation exposes plaintext session credentials, and restrict SSL VPN portal exposure to trusted sources where possible. | 9.8 | 100% | KEV ransomware |
| mass≈500,000 internet-exposed FortiOS SSL VPN portals (Fortinet cited ~480,000 affected devices) | |
| CVE-2019-5591 | Default-Configuration LDAP Impersonation in Fortinet FortiOS CVE-2019-5591 is a default-configuration flaw in Fortinet FortiOS (CWE-306, missing authentication for a critical function): when a FortiGate acts as an LDAP client over SSL/TLS for authentication purposes, the default configuration does not properly authenticate the LDAP server, allowing an unauthenticated attacker on the same subnet to impersonate the LDAP server. The attack requires adjacency (the attacker must be on the same network segment as the device's LDAP traffic) and only works where the device uses LDAP over TLS with the default, non-validating settings. A successful attacker can intercept sensitive authentication information, such as usernames and passwords, exchanged with the LDAP server, with high confidentiality impact but no integrity or availability impact per the CVSS score. Organizations running affected FortiOS releases with LDAP-over-TLS configured are exposed; FortiOS runs on one of the largest firewall/VPN installed bases, though the source data does not state exact affected version ranges or deployment counts. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known in-the-wild and ransomware use; late-2021 CISA and FBI advisories warned that APT actors were exploiting Fortinet bugs, including this one, for initial access, and no public PoC is known. Do: Upgrade affected FortiGate/FortiOS units to a fixed release (6.2.1+, 6.0.8+, 5.6.10+, or 5.4.12+) per Fortinet's instructions, as required by CISA's KEV listing. If patching is delayed, disable the use of SSL/TLS in the LDAP server configuration or restrict and monitor the network path between the FortiGate and the LDAP server. Inventory which devices use LDAPS for authentication and review authentication logs for signs of server impersonation or credential theft. | 6.5 | 18% | KEV ransomware |
| largetens of thousands of FortiGate deployments plausibly affected (a subset of a very large FortiOS installed base that connects to LDAP over TLS) | |
| CVE-2020-12812 | MFA Bypass via Username Case Change in Fortinet FortiOS SSL VPN Fortinet FortiOS SSL VPN improperly validates the second factor of authentication (FortiToken), allowing a user with valid primary credentials to log in without being prompted for their one-time token. The bypass is triggered by changing the letter case of the username (e.g., typing 'Admin' instead of 'admin'), a case-sensitivity handling flaw (CWE-178) in the authentication logic (CWE-287). An attacker who has stolen, phished, or reused a user's primary credentials can therefore gain full SSL VPN access without the multi-factor protection defenders assume is enforced. Any organization running an affected FortiOS SSL VPN portal with FortiToken two-factor authentication for users is exposed. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns a 49.3% probability of exploitation within 30 days (99th percentile); no public PoC is known. Do: Apply the FortiOS update per Fortinet's advisory, as required by CISA's KEV listing. Until patched, audit SSL VPN logs for successful logins in which no FortiToken second-factor prompt occurred (especially sessions authenticating with altered username case), and consider restricting the SSL VPN portal to trusted source addresses or disabling it temporarily. Any accounts found with second-factor-free VPN logins should have credentials rotated and be checked for follow-on compromise, given known ransomware use. | 9.8 | 49% | KEV ransomware |
| masson the order of hundreds of thousands of internet-exposed FortiOS SSL VPN portals (public scans in 2020-2021 counted roughly 150,000-500,000) |
Full article499 words · extracted from securityaffairs.com · click to collapse
Attackers are actively exploiting the CVE-2018-13379 flaw in Fortinet VPN to deploy the Cring ransomware to organizations in the industrial sector.
Threat actors are actively exploiting the CVE-2018-13379 vulnerability in Fortinet VPNs to deploy a new piece of ransomware, tracked as Cring ransomware (also known as Crypt3r, Vjiszy1lo, Ghost, Phantom), to organizations in the industrial sector.
The CVE-2018-13379 is a path traversal vulnerability in the FortiOS SSL VPN web portal that could be exploited by an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
The Cring ransomware appeared in the threat landscape in January, it was first reported by Amigo_A and the CSIRT team of Swisscom. This ransomware encrypts data from victims with AES-256 + RSA-8192 and then demands a ~ 2 BTC ransom to get the files back.
“An incident investigation conducted by Kaspersky ICS CERT experts at one of the attacked enterprises revealed that attacks of the Cring ransomware exploit a vulnerability in Fortigate VPN servers.” reads the post published by Kaspersky.
“Victims of these attacks include industrial enterprises in European countries. At least in one case, an attack of the ransomware resulted in a temporary shutdown of the industrial process due to servers used to control the industrial process becoming encrypted.”
Once gained access to a system within the target network, the attackers downloaded the Mimikatz utility to steal the credentials of Windows users who logged in to the compromised system.
Upon compromising the domain administrator account, threat actors could distributee malware to other systems on the same network. Attackers also used the Cobalt Strike post-exploitation framework to deploy the ransomware.
In one case, the ransomware infection of servers used to control the industrial process caused a temporary shutdown of the process.
“The primary causes of the incident include the use of an outdated and vulnerable firmware version on the Fortigate VPN server (version 6.0.2 was used at the time of the attack), which enabled the attackers to exploit the CVE-2018-13379 vulnerability and gain access to the enterprise network.” continues Kaspersky.
“The lack of timely antivirus database updates for the security solution used on attacked systems also played a key role, preventing the solution from detecting and blocking the threat. It should also be noted that some components of the antivirus solution were disabled, further reducing the quality of protection. Other factors contributing to the incident’s development included the user account privilege settings configured in domain policies and the parameteres of RDP access.“
Kaspersky also shared Indicators of compromise (IOCs) in its report.
Early April, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) published a joint alert to warn of attacks carried out by APT groups targeting Fortinet FortiOS servers using multiple exploits.
The threat actors are actively exploiting the following vulnerabilities in Fortinet FortiOS:
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Fortinet VPN)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/116480/cyber-crime/cring-ransomware-fortinet-vpn-flaw.html