Hackers Leak VPN Account Passwords From 87,000 Fortinet FortiGate Devices

Network security solutions provider Fortinet confirmed that a
malicious actor had unauthorizedly disclosed VPN login names and
passwords associated with 87,000 FortiGate SSL-VPN devices.

“These credentials were obtained from systems that remained
unpatched against CVE-2018-13379^[1]
at the time of the actor’s scan. While they may have since been
patched, if the passwords were not reset, they remain vulnerable,”
the company said^[2]
in a statement on Wednesday.

The disclosure comes after the threat actor leaked a list of
Fortinet credentials for free on a new Russian-speaking forum
called RAMP^[3]
that launched in July 2021 as well as on Groove ransomware’s data
leak site, with Advanced Intel noting^[4]
that the “breach list contains raw access to the top companies”
spanning across 74 countries, including India, Taiwan, Italy,
France, and Israel. “2,959 out of 22,500 victims are U.S.
entities,” the researchers said.

CVE-2018-13379^[5]
relates to a path traversal vulnerability in the FortiOS SSL VPN
web portal, which allows unauthenticated attackers to read
arbitrary system files, including the session file, which contains
usernames and passwords stored in plaintext.

Although the bug was rectified in May 2019, the security
weakness has been repeatedly^[6]
exploited^[7]
by multiple^[8]
adversaries^[9]
to deploy an array of malicious payloads^[10] on unpatched devices,
prompting Fortinet to issue a series of advisories in August 2019^[11], July 2020^[12], April 2021^[13], and again in June 2021^[14], urging customers to
upgrade affected appliances.

CVE-2018-13379 also emerged as one of the top most exploited flaws^[15] in 2020, according to a
list compiled by intelligence agencies in Australia, the U.K., and
the U.S. earlier this year.

In light of the leak, Fortinet is recommending companies to
immediately disable all VPNs, upgrade the devices to FortiOS
5.4.13, 5.6.14, 6.0.11, or 6.2.8 and above followed by initiating
an organization-wide password reset, warning that “you may remain
vulnerable post-upgrade if your users’ credentials were previously
compromised.”