CVE-2022-40684: Critical Authentication Bypass in FortiOS and FortiProxy
Fortinet has patched a critical authentication bypass in its FortiOS and FortiProxy products that could lead to administrator access.
Update October 13: We have added a Proof of Concept section.
On October 7, public reports began to circulate that Fortinet communicated directly with customers about a critical vulnerability in its FortiOS and FortiProxy products. This vulnerability, CVE-2022-40684, has been patched, but Fortinet has not released a full advisory yet via its Product Security Incident Response Team.
Fortinet usually follows a monthly release schedule for security advisories on the second Tuesday of every month, the same day as Microsoft’s Patch Tuesday. At the time this blog post was originally published, it remained to be seen whether Fortinet was going to follow the same schedule for the CVE-2022-40684 advisory. The following tweet contains an image taken from the support page behind a login portal.
Update: By now the full text of the e-mail and a screenshot of the internal advisory have been shared.
So here goes a screenshot of the unredacted full e-mail as shared on Facebook. Also containing possible #workarounds.#Fortinet #CVE202240684 #RCE #authbypass #advisory pic.twitter.com/ruVmYhyXA5
— Gitworm (@Gi7w0rm) October 7, 2022
On October 10, Fortinet published its full advisory to the public that added FortiSwitchManager to the list of affected products.
CVE-2022-40684 is a critical authentication bypass vulnerability that received a CVSSv3 score of 9.6. By sending specially crafted HTTP or HTTPS requests to a vulnerable target, a remote attacker with access to the management interface could perform administrator operations.
At the time of initial publication, there was no information on whether this vulnerability had been exploited in attacks. In the October 10 release, Fortinet did confirm that there has been “an instance” of exploitation in the wild. Given threat actors’ penchant for targeting FortiOS vulnerabilities, Fortinet’s recommendation to remediate this vulnerability “with the utmost urgency” is appropriate.
Proof of Concept
The table below maps the vulnerable and fixed version numbers for all affected products:
7.0.0 to 7.0.6
7.2.0 to 7.2.1
7.0.0 to 7.0.6
If you cannot apply patches immediately, Fortinet states that using a local-in-policy to limit access to the management interface. Fortinet also includes steps on disabling administrative access to the internet facing interface and steps on restricting access to trusted hosts in their FortiGate Hardening Guide. As the guide notes, these steps are part of their system administrator best practices.
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as they’re released. This link uses a search filter to ensure that all matching plugin coverage will appear as it is released. Customers can also use Plugin ID 73522 to identify the version of Fortinet Devices in your network. Please note that the plugin does require providing SSH credentials for the Fortinet device.
Get more information
- Fortinet PSIRT advisory for CVE-2022-40684
- FortiOS release notes for 7.2.2
- FortiOS release notes for 7.0.7
- Fortinet PSIRT
Join Tenable's Security Response Team on the Tenable Community.
Update October 10: The Background, Analysis and Solution sections have been updated to reflect new information from Fortinet PSIRT’s full advisory.
Cybersecurity News You Can Use
Enter your email and never miss timely alerts and security guidance from the experts at Tenable.