Summary
Security researchers have recently detected an exploitation campaign for the CVE-2024-55591 vulnerability, rated “Critical,” in Fortinet firewalls, targeting the publicly exposed management interfaces of FortiOS and FortiProxy.
Note: A Proof of Concept (PoC) for the exploitation of CVE-2024-55591 is reportedly available online.
Risk
Community Impact Rating: Critical (78.97)
Description and Potential Impacts
Security researchers have recently detected an exploitation campaign for the CVE-2024-55591 vulnerability, rated “Critical,” in Fortinet firewalls, targeting the publicly exposed management interfaces of FortiOS and FortiProxy.
This vulnerability – with a CVSS v3 score of 9.6 – of the “Authentication Bypass” type, could allow malicious actors to obtain:
- administrative access to devices
- ability to create new accounts
- authentication via SSL VPN
- access and modification of device configuration settings
- exfiltration of Active Directory credentials via DCSync
For any further information, we recommend consulting the link to the analysis, available in the References section.
Type
- Authentication Bypass
Affected products and/or versions
- FortiProxy 7.2.x, version 7.2.12 and earlier
- FortiProxy 7.0.x, version 7.0.19 and earlier
- FortiOS 7.0.x, version 7.0.16 and earlier
Mitigation actions
In line with the vendor’s statements, it is recommended to update vulnerable products following the instructions in the security bulletin in the References section.
Furthermore, it is important to inhibit the possibility of accessing the management interfaces of such devices from the Internet.
Finally, it is recommended to evaluate the verification and implementation – on your security devices – of the Indicators of Compromission (IoC) [1] provided in the “IoC” section.
[1] By definition, not all indicators of compromise are malicious. This CSIRT has no responsibility for the implementation of any proactive actions (e.g. blocklisting IoCs) related to the indicators provided. The information contained in this document represents the best understanding of the threat at the time of release.
References
https://www.fortiguard.com/psirt/FG-IR-24-535
https://arcticwolf.com/resources/blog/console-chaos-targets-fortinet-fortigate-firewalls/
1This estimate is made taking into account several parameters, including: CVSS, availability of patches/workarounds and PoC, diffusion of the affected software/devices in the reference community.
