FBI Issues Fortinet Flash Warning
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-13379 | Unauthenticated Path Traversal in Fortinet FortiOS SSL VPN CVE-2018-13379 is a path traversal flaw (CWE-22) in the Fortinet FortiOS SSL VPN web portal that allows an unauthenticated attacker to download FortiOS system files via specially crafted HTTP resource requests. By traversing directories through crafted requests to the exposed web portal, the attacker can retrieve sensitive files, a technique publicly documented as yielding the SSL VPN session file containing usernames and passwords in plaintext. Any organization running the SSL VPN web portal on a FortiGate appliance is affected, and risk is highest where the portal is directly reachable from the internet. The flaw is confirmed in the wild: it was added to the CISA KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public PoC is listed in the provided data, but credential theft tied to this bug has been widely reused by threat actors. Do: Apply the patched FortiOS release per Fortinet's vendor advisory immediately, as this is a CISA KEV required action; if the fixed version is not known from this data, follow Fortinet's FG-IR-18-384 advisory for the correct upgrade path. Rotate SSL VPN credentials and review VPN access logs for path-traversal requests, since successful exploitation exposes plaintext session credentials, and restrict SSL VPN portal exposure to trusted sources where possible. | 9.8 | 100% | KEV ransomware |
| mass≈500,000 internet-exposed FortiOS SSL VPN portals (Fortinet cited ~480,000 affected devices) | |
| CVE-2019-5591 | Default-Configuration LDAP Impersonation in Fortinet FortiOS CVE-2019-5591 is a default-configuration flaw in Fortinet FortiOS (CWE-306, missing authentication for a critical function): when a FortiGate acts as an LDAP client over SSL/TLS for authentication purposes, the default configuration does not properly authenticate the LDAP server, allowing an unauthenticated attacker on the same subnet to impersonate the LDAP server. The attack requires adjacency (the attacker must be on the same network segment as the device's LDAP traffic) and only works where the device uses LDAP over TLS with the default, non-validating settings. A successful attacker can intercept sensitive authentication information, such as usernames and passwords, exchanged with the LDAP server, with high confidentiality impact but no integrity or availability impact per the CVSS score. Organizations running affected FortiOS releases with LDAP-over-TLS configured are exposed; FortiOS runs on one of the largest firewall/VPN installed bases, though the source data does not state exact affected version ranges or deployment counts. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known in-the-wild and ransomware use; late-2021 CISA and FBI advisories warned that APT actors were exploiting Fortinet bugs, including this one, for initial access, and no public PoC is known. Do: Upgrade affected FortiGate/FortiOS units to a fixed release (6.2.1+, 6.0.8+, 5.6.10+, or 5.4.12+) per Fortinet's instructions, as required by CISA's KEV listing. If patching is delayed, disable the use of SSL/TLS in the LDAP server configuration or restrict and monitor the network path between the FortiGate and the LDAP server. Inventory which devices use LDAPS for authentication and review authentication logs for signs of server impersonation or credential theft. | 6.5 | 18% | KEV ransomware |
| largetens of thousands of FortiGate deployments plausibly affected (a subset of a very large FortiOS installed base that connects to LDAP over TLS) |
Full article352 words · extracted from infosecurity-magazine.com · click to collapse
The United States Federal Bureau of Investigation issued a flash warning Thursday over the exploitation of Fortinet vulnerabilities by advanced persistent threat (APT) groups.
According to the FBI, an APT actor group has "almost certainly" been exploiting a FortiGate appliance since at least May 2021 to access a web server hosting the domain for a US municipal government.
The APT actors may have established new user accounts on domain controllers, servers, workstations, and the active directories to help them carry out malicious activity on the network.
"Some of these accounts appear to have been created to look similar to other existing accounts on the network, so specific account names may vary per organization," said the FBI. However, the Feds warned organizations to be on the lookout for accounts created with the usernames "elie" or “WADGUtilityAccount.”
Once inside a network, the APT actors can conduct data exfiltration, data encryption, or other malicious activity.
The alert comes just one month after the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) warned that APT actors had gained access to devices on ports 4443, 8443, and 10443 for Fortinet FortiOS CVE-2018-13379, and enumerated devices for FortiOS CVE-2020- 12812 and FortiOS CVE-2019-5591.
The cyber-criminal activity appears to be focused on exploiting particular vulnerabilities rather than specific sectors, as the APT actors have been observed actively targeting a broad range of victims across multiple industries.
"The fact that we continue to see these legacy vulnerabilities being exploited in spite of these alerts is a cautionary tale that unpatched flaws remain a valuable tool for APT groups and cyber-criminals in general," commented Satnam Narang, staff research engineer at Tenable.
They added: "Unpatched vulnerabilities, not zero-days, are the biggest threat to most organizations today because it gets attackers to their end goal in the fastest and cheapest way. It is imperative that both public sector and private organizations that use the FortiGate SSL VPN apply these patches immediately to prevent future compromise.”
Narang said that the risk posed by unpatched vulnerabilities was further heightened by the broad shift of the workforce to remote working over the past year.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/fbi-issues-fortinet-flash-warning/