Advanced actor targets Fortinet FortiOS in attacks on govt entities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-41328 | Path Traversal in Fortinet FortiOS Exploited in Targeted Attacks CVE-2022-41328 is a path traversal flaw (CWE-22) in Fortinet FortiOS in which the system fails to properly limit file paths, allowing crafted CLI commands to escape the restricted directory. A privileged attacker — one who already has CLI access to the device — can issue these crafted commands to read and write arbitrary files on the underlying Linux system, effectively breaking out of the FortiOS CLI sandbox. That post-compromise capability is valuable for stealth and persistence, since changes to system files on the underlying OS may not be visible through normal FortiOS administration. Organizations running FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.9, or any release before 6.4.11 are affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-14, carries a high EPSS score (10.7% probability of exploitation within 30 days, 96th percentile), and public reporting describes its use in targeted cyberattacks on government entities attributed to the espionage group tracked as UNC3886, though no public proof-of-concept code is known. Do: Upgrade all affected FortiGate/FortiOS devices to a fixed release beyond the affected ranges — 7.2.4 or later, 7.0.10 or later, or 6.4.11 or later — per Fortinet's advisory, as required by the CISA KEV entry. Restrict privileged CLI access (admin accounts, trusted-host/local-in policies) and review CLI logs plus the underlying Linux filesystem for unexpected file changes as signs of compromise, particularly on government or otherwise high-value networks given UNC3886 targeting. | 7.1 | 11% | KEV |
| masshundreds of thousands of FortiGate deployments (well over 100,000 internet-facing FortiGates appear in public scans) |
Full article411 words · extracted from securityaffairs.com · click to collapse
An unknown threat actor is targeting Government entities and large organizations by exploiting a security flaw in Fortinet FortiOS.
Fortinet researchers are warning of an advanced threat actor that is targeting governmental or government-related entities.
The unknown threat actor is exploiting a vulnerability in Fortinet FortiOS software, tracked as CVE-2022-41328, that may allow a privileged attacker to read and write arbitrary files via crafted CLI commands.
The CVE-2022-41328 vulnerability (CVSS score: 6.5) is a path traversal issue in FortiOS can can result in arbitrary code execution.
“A improper limitation of a pathname to a restricted directory vulnerability (‘path traversal’) [CWE-22] in FortiOS may allow a privileged attacker to read and write arbitrary files via crafted CLI commands.” reads the advisory published by Fortinet.
The vulnerability impacts FortiOS versions 6.0, 6.2, 6.4.0 through 6.4.11, 7.0.0 through 7.0.9, and 7.2.0 through 7.2.3. The company addressed the vulnerability with the release of versions 6.4.12, 7.0.10, and 7.2.4 respectively.
Fortinet launched an investigation into the attacks after the FortiGate devices of one customer suddenly halted and failed to reboot. The devices halted displaying the following error message:
“System enters error-mode due to FIPS error: Firmware Integrity self-test failed”
The failure of the integrity test blocks the re-boot of the device to protect the integrity of the network.
The researchers discovered that the attackers modified the /sbin/init folder in the firmware image, they noticed the presence of a new file /bin/fgfm. The modification aims at providing a persistent access to the attacker.
“The modification to /sbin/init ensures that /bin/fgfm, which may provide an attacker with persistent access and control, runs before proceeding with regular boot-up actions.” reads the analysis published by Fortinet.
Upon executing the fgfm malware, it contacts a remote server (C2) and awaits for commands to execute.
The malicious code can perform various actions depending on the commands it receives from the C&C server, including exit program, exfiltrate data, download/write files, establish a remote shell.
The security firm pointed out that the exploit requires a deep understanding of FortiOS and the underlying hardware, a circumstance that suggests the involvement of an advanced actor.
The attackers were able to create a custom implants based on the reverse-engineering of various parts of FortiOS.
“The attack is highly targeted, with some hints of preferred governmental or government-related targets.” concludes the company that also provided Indicators of Compromise.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Fortinet)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/143458/hacking/attacks-fortinet-fortios.html