335,923 out of 489,337 Fortinet firewalls vulnerable to CVE-2023
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-27997 | Pre-Auth Heap Buffer Overflow RCE in Fortinet FortiOS/FortiProxy SSL-VPN CVE-2023-27997 is a heap-based buffer overflow (CWE-122, with associated out-of-bounds write CWE-787) in the SSL-VPN component of Fortinet FortiOS and FortiProxy, reachable by unauthenticated users. A remote attacker can trigger it with specially crafted requests to the SSL-VPN web interface, gaining the ability to execute arbitrary code or commands on the gateway. Full control of an edge VPN/firewall appliance enables credential theft, session hijacking, and pivoting into the protected network, which makes the bug attractive to ransomware operators. Any organization exposing the SSL-VPN portal on the affected FortiOS builds (7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below) or FortiProxy builds (7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and 1.1/1.2 all versions) is potentially exposed. The flaw is under active exploitation: CISA added it to the KEV on 2023-06-13 with known ransomware use, EPSS estimates an ~86% probability of exploitation within 30 days (100th percentile), and reporting indicates it was likely being exploited in the wild, with Fortinet also warning that some attackers retained access to FortiGate devices even after patching. Do: Apply Fortinet's updates to all SSL-VPN-enabled FortiOS and FortiProxy appliances as required by the CISA KEV listing, upgrading each affected branch beyond the listed versions (end-of-life FortiProxy 1.1/1.2 requires migration to a supported release); if SSL-VPN is not needed, disable the web portal or restrict it to trusted source addresses. After patching, hunt for signs of compromise and rotate credentials and VPN-related secrets, since Fortinet warned that some attackers retained access to FortiGate devices post-patching. | 9.8 | 86% | KEV ransomware |
| masson the order of several hundred thousand internet-exposed SSL-VPN endpoints (≈300k–500k per public scans) |
Full article538 words · extracted from securityaffairs.com · click to collapse
Researchers reported that there are 490,000 Fortinet firewalls exposing SSL VPN interfaces on the internet, and roughly 69% of them are still vulnerable to CVE-2023-27997.
In Mid-June Fortinet addressed a critical flaw, tracked as CVE-2023-27997 (CVSS score: 9.2), in FortiOS and FortiProxy that is likely exploited in a limited number of attacks.
“A heap-based buffer overflow vulnerability [CWE-122] in FortiOS and FortiProxy SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.” reads the advisory
The vulnerability is a heap-based buffer overflow issue and according to the vendor it may have been exploited in a limited number of attacks aimed at government, manufacturing, and critical infrastructure sectors.
“Our investigation found that one issue (FG-IR-23-097) may have been exploited in a limited number of cases and we are working closely with customers to monitor the situation.” states the report published by Fortinet. “For this reason, if the customer has SSL-VPN enabled, Fortinet is advising customers to take immediate action to upgrade to the most recent firmware release. If the customer is not operating SSL-VPN the risk of this issue is mitigated – however, Fortinet still recommends upgrading.”
A remote attacker can trigger the vulnerability to execute arbitrary code or commands by sending specifically crafted requests to vulnerable devices.
The vulnerability was reported to Fortinet by the researcher Charles Fol and Dany Bach (DDXhunter) from Lexfo Security. The researcher describes the issue as a reachable pre-authentication that impacts every SSL VPN appliance.
Researchers from the security firm Bishop Fox reported that there are 490,000 affected SSL VPN interfaces exposed on the internet, and roughly 69% of them are currently unpatched.
Bishop Fox’s Capability Development team built an exploit for the vulnerability CVE-2023-27997.
The researchers created their own Shodan query to locate the vulnerable instance only, they searched for any servers returning the HTTP response header Server: xxxxxxxx-xxxxx—oddly and then filter down on those that redirect to /remote/login, the path that exposes the SSL VPN interface.
$ shodan count '"Server: xxxxxxxx-xxxxx" http.html:"top.location=/remote/login"' 489337
The query returns approximately 490,000 instances, a figure that is double the one obtained using a query that searches for the exposed SSL certificate.
“If only 153,414 devices on the internet are patched, that leaves 335,923 / 489,337 = 69% unpatched.” states the analysis published by Bishop Fox.
The analysis of the Last-Modified header values revealed that there are a lot of outliers in 2018 and earlier, the researchers noticed that there’s a handful of devices running 8-year-old FortiOS on the internet. These devices are multiple critical vulnerabilities that have been addressed by the company across the years and that have proof-of-concept exploit code publicly available.
Logarithmic view of FortiOS installations from April 2014 to June 2023
FortiOS installations of versions 5,6, and 7 from December 2015 to June 2023
“There’s lots of version 7 (released early 2021), and a ton of version 6 which is gradually reaching end of life.” continues the report.
Experts recommend organizations using FortiGate firewall, or anything else powered by FortiOS, to follow Fortinet’s advisory for this issue and upgrade their firmware immediately.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Fortinet)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/148110/hacking/fortinet-fortios-vulnerable-devices-online.html