PoC Exploit Released for Critical Fortinet Auth Bypass Bug Under Active Attacks

A proof-of-concept (PoC) exploit code has been made available
for the recently disclosed critical security flaw affecting
Fortinet FortiOS, FortiProxy, and FortiSwitchManager, making it
imperative that users move quickly to apply the patches.

“FortiOS exposes a management web portal that allows a user to
configure the system,” Horizon3.ai researcher James Horseman
said^[1]. “Additionally, a user
can SSH into the system which exposes a locked down CLI
interface.”

The issue, tracked as CVE-2022-40684^[2]
(CVSS score: 9.6), concerns an authentication bypass^[3]
vulnerability that could allow a remote attacker to perform
malicious operations on the administrative interface via specially
crafted HTTP(S) requests.

A successful exploitation of the shortcoming is tantamount to
granting complete access “to do just about anything” on the
affected system, including altering network configurations, adding
malicious users, and intercept network traffic.

That said, the cybersecurity firm said that there are two
essential prerequisites when making such a request –

• Using the Forwarded header, an attacker is able to set the
  client_ip to “127.0.0.1”
• The “trusted access” authentication check verifies that the
  client_ip is “127.0.0.1” and the User-Agent is “Report Runner” both
  of which are under attacker control

The release of the PoC comes as Fortinet cautioned^[4]
that it’s already aware of an instance of active exploitation of
the flaw in the wild, prompting the U.S. Cybersecurity and
Infrastructure Security Agency (CISA) to issue an advisory urging
federal agencies to patch the flaw by November 1, 2022.

Threat intelligence firm GreyNoise has detected^[5]
12 unique IP addresses weaponizing CVE-2022-40684 as of October 13,
2022, with a majority of them located^[6]
in Germany, followed by Brazzil, the U.S., China, and France.