FortiOS SSL-VPN Vulnerability Discovered

Dataprise Defense Digest

Severity: 9 (High)

Published: December 12^th, 2022

EXECUTIVE SUMMARY

A vulnerability has been discovered in Fortinet’s FortiOS SSL VPN system. This vulnerability could allow an unauthenticated attacker to execute code remotely on the Fortinet VPN which could give them root-level access to the appliance. Fortinet is urging all customers to be aware of this vulnerability.

Dataprise is aware of the critical nature of this vulnerability and has completed a review of all available analysis of these vulnerabilities and the potential impact to our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customer-facing service interruptions.

If your organization’s Fortinet appliance is covered under a Dataprise Managed Service agreement, we will send a follow-up communication with details on our mitigation efforts. Additionally, the Dataprise Cybersecurity team has implemented detection rules in our SIEM to identify any attempts to exploit any Fortinet SSL VPNs that are being monitored by our SOC under a Managed Security Services plan.

IMPACT

The vulnerability disclosure is new and is still being investigated to fully understand the impact, however, all customers should be aware of this vulnerability and should ensure all vulnerable Fortinet appliances are running an up-to-date version of FortiOS SSL-VPN server and client. A list of affected versions has been enumerated below.

DETAILED ANALYSIS

This remote code execution vulnerability has been identified as a memory exploitation in the FortiOS code. Researchers and security teams have observed attackers exploiting this vulnerability in the wild. Indicators of Compromise are:

• Log Entries:
  Logdesc=”Application crashed” and msg=”[…] application:sslvpnd,[…], Signal 11 received, Backtrace: […]“
• IP Addresses:
  • 188.34.130[.]40:444
  • 103.131.189[.]143:30080,30081,30443,20443
  • 192.36.119[.]61:8443,444
  • 172.247.168[.]153:8033

• Files Left After Successful Exploitation:

/data/lib/libips.bak
/data/lib/libgif.so
/data/lib/libiptcp.so
/data/lib/libipudp.so
/data/lib/libjepg.so
/var/.sslvpnconfigbk
/data/etc/wxd.conf
/flash

MITIGATION

Fortinet urges all customers to update to the latest version for FortiOS from the following vulnerable versions:

• FortiOS version 7.2.0 through 7.2.2
• FortiOS version 7.0.0 through 7.0.8
• FortiOS version 6.4.0 through 6.4.10
• FortiOS version 6.2.0 through 6.2.11
• FortiOS-6K7K version 7.0.0 through 7.0.7
• FortiOS-6K7K version 6.4.0 through 6.4.9
• FortiOS-6K7K version 6.2.0 through 6.2.11
• FortiOS-6K7K version 6.0.0 through 6.0.14

SOURCES

• https://securityaffairs.co/wordpress/139569/hacking/fortinet-fortios-ssl-vpn-bug.html

AUTHORS

• Susan Verdin, Cybersecurity Analyst
• Stephen Jones, VP Cybersecurity