US says APTs are using Fortinet bugs to gain initial access for future attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-5591 | Default-Configuration LDAP Impersonation in Fortinet FortiOS CVE-2019-5591 is a default-configuration flaw in Fortinet FortiOS (CWE-306, missing authentication for a critical function): when a FortiGate acts as an LDAP client over SSL/TLS for authentication purposes, the default configuration does not properly authenticate the LDAP server, allowing an unauthenticated attacker on the same subnet to impersonate the LDAP server. The attack requires adjacency (the attacker must be on the same network segment as the device's LDAP traffic) and only works where the device uses LDAP over TLS with the default, non-validating settings. A successful attacker can intercept sensitive authentication information, such as usernames and passwords, exchanged with the LDAP server, with high confidentiality impact but no integrity or availability impact per the CVSS score. Organizations running affected FortiOS releases with LDAP-over-TLS configured are exposed; FortiOS runs on one of the largest firewall/VPN installed bases, though the source data does not state exact affected version ranges or deployment counts. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known in-the-wild and ransomware use; late-2021 CISA and FBI advisories warned that APT actors were exploiting Fortinet bugs, including this one, for initial access, and no public PoC is known. Do: Upgrade affected FortiGate/FortiOS units to a fixed release (6.2.1+, 6.0.8+, 5.6.10+, or 5.4.12+) per Fortinet's instructions, as required by CISA's KEV listing. If patching is delayed, disable the use of SSL/TLS in the LDAP server configuration or restrict and monitor the network path between the FortiGate and the LDAP server. Inventory which devices use LDAPS for authentication and review authentication logs for signs of server impersonation or credential theft. | 6.5 | 18% | KEV ransomware |
| largetens of thousands of FortiGate deployments plausibly affected (a subset of a very large FortiOS installed base that connects to LDAP over TLS) | |
| CVE-2020-12812 | MFA Bypass via Username Case Change in Fortinet FortiOS SSL VPN Fortinet FortiOS SSL VPN improperly validates the second factor of authentication (FortiToken), allowing a user with valid primary credentials to log in without being prompted for their one-time token. The bypass is triggered by changing the letter case of the username (e.g., typing 'Admin' instead of 'admin'), a case-sensitivity handling flaw (CWE-178) in the authentication logic (CWE-287). An attacker who has stolen, phished, or reused a user's primary credentials can therefore gain full SSL VPN access without the multi-factor protection defenders assume is enforced. Any organization running an affected FortiOS SSL VPN portal with FortiToken two-factor authentication for users is exposed. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns a 49.3% probability of exploitation within 30 days (99th percentile); no public PoC is known. Do: Apply the FortiOS update per Fortinet's advisory, as required by CISA's KEV listing. Until patched, audit SSL VPN logs for successful logins in which no FortiToken second-factor prompt occurred (especially sessions authenticating with altered username case), and consider restricting the SSL VPN portal to trusted source addresses or disabling it temporarily. Any accounts found with second-factor-free VPN logins should have credentials rotated and be checked for follow-on compromise, given known ransomware use. | 9.8 | 49% | KEV ransomware |
| masson the order of hundreds of thousands of internet-exposed FortiOS SSL VPN portals (public scans in 2020-2021 counted roughly 150,000-500,000) |
Full article378 words · extracted from therecord.media · click to collapse
In a joint security alert published today, on Friday, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) said they'd observed multiple state-sponsored hacking groups scanning the web for Fortinet devices in order to find and gain access to sensitive networks so they could launch future attacks. FBI and CISA officials attributed these attacks to "APT actors," a term generally used to described foreign government-backed hacking groups. The two agencies said these APT groups are currently scanning the web for Fortinet devices that run unpatched versions of the FortiOS operating system that are vulnerable to three security flaws tracked as CVE 2018-13379, CVE-2020-12812, and CVE-2019-5591. The APT actors may be using any or all of these CVEs to gain access to networks across multiple critical infrastructure sectors to gain access to key networks as pre-positioning for follow-on data exfiltration or data encryption attacks. While the two agencies haven't formally confirmed any intrusions, they are now asking Fortinet device owners to update their systems, audit admin accounts, and implement two-factor authentication, among many other recommendations — see security alert for more [PDF]. Government, commercial, and technology services networks may be at a heightened risk, according to US government officials. APT groups previously seen exploiting Fortinet bugs include Chinese and Iranian adversaries, such as APT5 and MuddyWater respectively, although, the FBI and CISa hasn't formally named any group yet. This is also the second time the FBI and CISA have released a joint security advisory on a Fortinet-related vulnerability. They released the first on October 12, 2020, when they warned that APT actors had been seen chaining vulnerabilities in VPN products (Fortinet, Pulse Secure) together with Windows bugs (ZeroLogon) to breach and exfiltrate data government and corporate networks. At the time, the two agencies confirmed successful attacks, some of which allowed intruders to gain "unauthorized access to elections support systems."CISA and FBI officials also warned about Fortinet last year
No previous article
No new articles
Catalin Cimpanu
is a cybersecurity reporter who previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/us-says-apts-are-using-fortinet-bugs-to-gain-initial-access-for-future-attacks