Black Arrow Cyber Advisory 12 February 2024 – Fortinet FortiOS Vulnerability in SSL VPN

Executive Summary

Fortinet have released a patch to fix a critical vulnerability in their FortiOS product, stating that is potentially being exploited in the wild. Successful exploitation of the vulnerability could allow a remote unauthorised attacker to execute code or commands.

What’s the risk to me or my business?

There is a risk that organisations using vulnerable versions of FortiOS are leaving themselves at risk of allowing an unauthenticated remote attacker to perform arbitrary code execution. This means an attacker could potentially gain unauthorised access and perform actions that could impact the confidentiality, integrity, and availability of the organisations data. This vulnerability only impacts organisations who have SSL VPN enabled.

The affected versions of FortiOS and FortiProxy are:

FortiOS

FortiOS 7.4 (7.4.0 through 7.4.2) – upgrade to 7.4.3 or above.

FortiOS 7.2 (7.2.0 through 7.2.6) – upgrade to 7.2.7 or above.

FortiOS 7.0 (7.0.0 through 7.0.13) – upgrade to 7.0.14 or above.

FortiOS 6.4 (6.4.0 through 6.4.14) – upgrade to 6.4.15 or above.

FortiOS 6.2 (6.2.0 through 6.2.15) – upgrade to 6.4.15 or above.

FortiOS 6.0 (all versions) - migrate to fixed release.

FortiProxy

FortiProxy 7.4 (7.4.0 through 7.4.2) - upgrade to 7.4.3 or above.

FortiProxy 7.2 (7.2.0 through 7.2.8) - upgrade to 7.2.9 or above.

FortiProxy 7.0 (7.0.0 through 7.0.14) - upgrade to 7.0.15 or above.

FortiProxy 2.0 (2.0.0 through 2.0.13) - upgrade to 2.0.14 or above.

FortiProxy 1.2 (all versions) - migrate to fixed release.

FortiProxy 1.1 (all versions) - migrate to fixed release.

FortiProxy 1.0 (all versions) - migrate to fixed release.

What can I do?

Black Arrow recommends applying the available patches for the vulnerability immediately due its severity. Further information can be found in the Fortigaurd security update below. Organisations have also been advised to disable SSL VPN if they cannot apply patches immediately, however this is not a long term solution.

Technical Summary

CVE-2024-2176 – This is a out-of-bound write vulnerability in the sslvpnd which may allow a remote unauthenticated attacker to execute arbitrary code or commands using  specifically crafted HTTP requests. 

Further information on the FortiOS vulnerability can be found here:

https://www.fortiguard.com/psirt/FG-IR-24-015

Further information on upgrading can be found here:

https://docs.fortinet.com/upgrade-tool

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity