Maximize your protection, eliminate business risks.
Optimize and modernize with cloud transformation.
Empower your people to work securely from anywhere.
What it takes to convince leadership that migrating to the cloud is the right move.
Let us handle IT so you can focus on growing your business.
Get multichannel 24/7/365 expert end-user support.
Stay ahead of attacks with 24/7 protection and monitoring.
Maximize uptime with with industry-leading DRaaS.
Improve efficiency, productivity and outcomes with cloud.
Ensure all mobile devices, everywhere, are secure.
Gain a competitive edge with strategic IT solutions.
This battle-tested checklist enables your team to swiftly initiate a ransomware response.
IT for businesses of all sizes, in any industry.
Empower institution growth with custom IT solutions.
Ensure your firm is always in compliance.
Improve patient care and staff morale.
Deal with pressing legal matters, not IT.
Keep up with the evolving digital landscape.
Focus on your mission by outsourcing IT.
Accelerate PE client deals and secure data.
Leverage your technology as a strategic asset.
Execute initiatives and develop IT strategies.
Get the latest industry insights and trends.
Join us at events in person and online.
Hear from clients and learn more about strategic IT.
See how Dataprise can make IT your greatest asset.
Get informative technical resources from IT experts.
Stay on stop of emerging cybersecurity threats.
Discover the key areas of DR your organization needs to address to ensure downtime is minimized.
Gain a strategic asset by bringing harmony to IT.
Ensure 24/7 support and security with dedicated teams.
Drive business forward by partnering with Dataprise.
Meet our one-of-a-kind leadership team.
Discover the recognition Dataprise has earned.
Help us help businesses with strategic IT.
Embracing different perspectives and backgrounds.
Find a Dataprise location near you.
Dataprise is committed to empowering more women to consider a career in technology.
Defense Digests
Table of content
ID: D3-2022-0008-1
Severity: 9 (High)
Published: October 7, 2022
Fortinet has privately released a security flaw impacting FortiGate firewalls and FortiProxy web proxies, allowing the devices to be susceptible to remote unauthorized actions. Fortinet is advising customers that the following FortiOS versions are impacted; 7.0.0.0 to 7.0.6 and from 7.2.0 to 7.2.1. The impacted versions of FortiProxy include 7.0.0 to 7.0.6 and 7.2.0.
At the time of this publication the CVE being used to track this is CVE-2022-40684. Since this vulnerability is currently not public, the vector has not yet been released. We will update this D3 when more information becomes available. It is important to note that Fortinet is advising customers to immediately upgrade any impacted FortiOS or FortiProxy appliance.
The exploitation of this vulnerability can allow an unauthorized attacker to gain administrative access to the affected FortiGuard or FortiProxy product.
FortiOS and FortiProxy systems were identified on October 6th to have a potential authentication bypass on the administrative login portal. This was quickly assigned CVE-2022-40684 and given a criticality of 9.6 as this can be remotely exploited with no authentication credentials and gives the threat actor administrative level privileges on the appliance.
The actual attack is difficult to fully outline in technical terms due to limited reporting and information, however the advanced alert sent to FortiGate customers outlines it as related to CWE-88 which indicates that the login fields for the administrative console does not handle input validation well and allows command injection from the authentication console which is a known issue in many applications built on a PHP backend.
With this in mind, actors can access publicly exposed administrative consoles and inject scripts that allow the actor to access the Linux subsystem to read and potentially write into the device. This can allow an attacker to read all files on the system as well as potentially inject a malicious user into the system or change credentials for an existing user with minimal effort and only a small amount of skill using perl scripting.
Fortinet is recommending that clients immediately upgrade FortiOS to 7.0.7 , 7.2.2, or above. FortiProxy should be upgraded to version 7.07, 7.2.1, or above.
If vulnerable devices are unable to be upgraded, all external facing HTTPS (443) Administration should be disabled and restricted to known IPs or access to the administrative portal should be restricted using a local-in-policy. Once the devices have been updated, and input validation is implemented, this feature can be turned back on. For more insight into the local workaround please reference the reddit source below.
Dataprise understands the severity of this vulnerability and is currently working with our clients on the remediation steps. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customer-facing service interruptions.
If your organization has affected Fortinet devices covered under a Dataprise Managed Service agreement, we will send a follow-up communication with details on your mitigation efforts.
INSIGHTS
Subscribe to get real-time notifications when a new Dataprise Defense Digest is published.