CVE-2022-40684: Critical Authentication Bypass in FortiOS and FortiProxy

Fortinet has patched a critical authentication bypass in its FortiOS and FortiProxy products that could lead to administrator access.

Background

On October 7, public reports began to circulate that Fortinet communicated directly with customers about a critical vulnerability in its FortiOS and FortiProxy products. This vulnerability, CVE-2022-40684, has been patched, but Fortinet has not released a full advisory yet via its Product Security Incident Response Team. 

Fortinet usually follows a monthly release schedule for security advisories on the second Tuesday of every month, the same day as Microsoft’s Patch Tuesday. It remains to be seen whether it will follow the same schedule for the CVE-2022-40684 advisory. The following tweet contains an image taken from the email communication sent to Fortinet customers.

Update: By now the full text of the e-mail and a screenshot of the internal advisory have been shared.
So here goes a screenshot of the unredacted full e-mail as shared on Facebook. Also containing possible #workarounds.#Fortinet #CVE202240684 #RCE #authbypass #advisory pic.twitter.com/ruVmYhyXA5

— Gitworm (@Gi7w0rm) October 7, 2022

Analysis

CVE-2022-40684 is a critical authentication bypass vulnerability that received a CVSSv3 score of 9.6. By sending specially crafted HTTP or HTTPS requests to a vulnerable target, a remote attacker with access to the management interface could perform administrator operations.

At this time, there is no information on whether this vulnerability has been exploited in attacks. But, given threat actors’ penchant for targeting FortiOS vulnerabilities, Fortinet’s recommendation to remediate this vulnerability “with the utmost urgency” is appropriate.

Solution

The communications Fortinet sent to customers that have now been shared publicly on Twitter, outline the following vulnerable and fixed version numbers:

If you cannot apply patches immediately, Fortinet states that using a local-in-policy to limit access to the management interface. Fortinet also includes steps on disabling administrative access to the internet facing interface and steps on restricting access to trusted hosts in their FortiGate Hardening Guide. As the guide notes, these steps are part of their system administrator best practices.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released. This link uses a search filter to ensure that all matching plugin coverage will appear as it is released. Customers can also use Plugin ID 73522 to identify the version of Fortinet Devices in your network. Please note that the plugin does require providing SSH credentials for the Fortinet device.

Get more information

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.