Sunday, May 19, 2024

FortiOS SSL-VPN Bug Let Attackers Execute Arbitrary Code Remotely

A critical vulnerability in FortiOS SSL-VPN let attackers perform unauthenticated arbitrary code execution remotely, and this flaw has been tracked as CVE-2022-42475.

This vulnerability resides in FortiOS sslvpnd and it could potentially be exploited by unauthenticated attackers to perform code execution on vulnerable devices remotely.

In response to an actively exploited FortiOS SSL-VPN flaw, Fortinet strongly urged all its customers to immediately patch their appliances. 

Moreover, a French cybersecurity firm known as Olympe Cyberdefense disclosed this zero-day vulnerability to the public for the first time.

Flaw Profile

  • CVE ID: CVE-2022-42475
  • Description: A heap-based buffer overflow bug.vul
  • CVSSv3 Score: 9.3
  • Severity: Critical
  • Impact: Execute unauthorized code or commands
  • IR Number: FG-IR-22-398
  • Date: Dec 12, 2022

This critical flaw was quietly fixed by Fortinet in FortiOS 7.2.3 on 28th November 2022. Even there is no information that has been released by Fortinet about how this zero-day vulnerability has been exploited by third parties.

On the 7th of December 2022, the company published a private TLP:Amber advisory in which it mentioned further details about this untold zero-day vulnerability.

Affected Products

Here below we have mentioned all the products that are affected:-

  • FortiOS version 7.2.0 through 7.2.2
  • FortiOS version 7.0.0 through 7.0.8
  • FortiOS version 6.4.0 through 6.4.10
  • FortiOS version 6.2.0 through 6.2.11
  • FortiOS-6K7K version 7.0.0 through 7.0.7
  • FortiOS-6K7K version 6.4.0 through 6.4.9
  • FortiOS-6K7K version 6.2.0 through 6.2.11
  • FortiOS-6K7K version 6.0.0 through 6.0.14

Solutions

Here below we have mentioned solutions offered by the company:-

  • Please upgrade to FortiOS version 7.2.3 or above
  • Please upgrade to FortiOS version 7.0.9 or above
  • Please upgrade to FortiOS version 6.4.11 or above
  • Please upgrade to FortiOS version 6.2.12 or above
  • Please upgrade to FortiOS-6K7K version 7.0.8 or above
  • Please upgrade to FortiOS-6K7K version 6.4.10 or above
  • Please upgrade to FortiOS-6K7K version 6.2.12 or above
  • Please upgrade to FortiOS-6K7K version 6.0.15 or above

For now, as a recommendation, experts have strongly urged users to immediately patch their vulnerable devices to prohibit the further exploitation of this flaw.

Apart from this, cybersecurity researchers have also recommended users monitor logs and disable the VPN-SSL functionality in case any user is unable to apply the patches right now. 

Even in order to limit the number of connections that can be made from a specific IP address, you should create access rules.

Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book

Website

Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles