Potential Exploitation of Critical FortiOS SSL VPN 0-Day

Dataprise Defense Digest 

ID: D3-2024-0001-1

Severity: Critical (9.8)

Published: February 9, 2024 

EXECUTIVE SUMMARY 

On February 8, 2024, Fortinet disclosed information about a new Fortinet Remote Code Execution (RCE) flaw in its SSL VPN that has a high likelihood of being exploited in the wild. Fortinet’s recommended solution is to upgrade any vulnerable FortiOS to the latest version. If upgrading is not feasible, there is workaround that mitigates the RCE vulnerability by disabling the SSL VPN functionality. Dataprise advises that Chinese state-sponsored threat actors known as Volt Typhoon are known to target FortiOS vulnerabilities to deploy custom malware known as COATHANGER, a custom remote access trojan (RAT) designed to infect Fortigate network security appliances.

Dataprise is aware of the critical nature of this vulnerability and is conducting a review of all available analyses of these vulnerabilities and the potential impact on our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customer-facing service interruptions. If your organization’s Fortinet appliance is covered under a Dataprise Managed Service agreement, we will send a follow-up communication with details on our mitigation efforts.

DETAILED ANALYSIS 

This critical vulnerability (9.8 CVSS) is being tracked as CVE-2024-21762. Successful exploitation of this out-of-bounds write vulnerability in FortiOS could allow an unauthenticated attacker to perform remote code execution via maliciously crafted requests.

Dataprise strongly advises prioritizing the upgrade of affected FortiOS versions to the latest version that is not affected by the vulnerability.

AFFECTED VERSIONS

The FortiOS versions impacted by the vulnerability are the following:

• FortiOS 7.4 (versions 7.4.0 through 7.4.2).
• FortiOS 7.2 (versions 7.2.0 through 7.2.6).
• FortiOS 7.0 (versions 7.0.0 through 7.0.13).
• FortiOS 6.4 (versions 6.4.0 through 6.4.14).
• FortiOS 6.2 (versions 6.2.0 through 6.2.15).
• FortiOS 6.0 (versions 6.0 all versions).

MITIGATION

Fortinet has provided the following solution pertaining to the specified affected versions:

• FortiOS 7.4      7.4.0 through 7.4.2       Upgrade to 7.4.3 or above.
• FortiOS 7.2      7.2.0 through 7.2.6       Upgrade to 7.2.7 or above.
• FortiOS 7.0      7.0.0 through 7.0.13     Upgrade to 7.0.14 or above.
• FortiOS 6.4      6.4.0 through 6.4.14     Upgrade to 6.4.15 or above.
• FortiOS 6.2      6.2.0 through 6.2.15     Upgrade to 6.2.16 or above.
• FortiOS 6.0      6.0 all versions              Migrate to a fixed release.

REFERENCES

• https://www.fortiguard.com/psirt/FG-IR-24-015
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-21762
• https://thehackernews.com/2024/02/fortinet-warns-of-critical-fortios-ssl.html?m=1
• https://www.opencve.io/cve/CVE-2024-21762
• https://www.bleepingcomputer.com/news/security/new-fortinet-rce-flaw-in-ssl-vpn-likely-exploited-in-attacks/

CONTRIBUTING AUTHORS 

• Josh McNulty, vCISO
• Stephen Jones, VP Cybersecurity