Fortinet warns of auth bypass zero-day exploited to hijack firewalls

Fortinet warns of auth bypass zero-day exploited to hijack firewalls

Information:

Fortinet is a leading cybersecurity company that protects organizations, service providers, and large government agencies worldwide from cyber threats. Fortinet empowers customers with deep threat intelligence and enables them to build intelligent defenses that keep their businesses running smoothly. To meet the ever-increasing demands for performance in today's and tomorrow's borderless networks, Fortinet's innovative Security Fabric architecture offers unparalleled security capabilities that can withstand any threat, whether it's in the network, applications, cloud, mobile, or IoT.

Incident :

This security flaw (tracked as CVE-2024-55591) impacts FortiOS 7.0.0 through 7.0.16, FortiProxy 7.0.0 through 7.0.19, and FortiProxy 7.2.0 through 7.2.12. Successful exploitation allows remote attackers to gain super-admin privileges by making malicious requests to the Node.js websocket module.

  Fortinet says attackers exploiting the zero-day in the wild are creating randomly generated admin or local users on compromised devices and are adding them to existing SSL VPN user groups or to new ones they also add.

  They've also been observed adding or changing firewall policies and other settings and logging in to SSLVPN using previously created rogue accounts "to get a tunnel to the internal network.

1.After logging in through the vulnerability, the logs will show a random source IP and destination IP:

type="event" subtype="system" level="information" vd="root" logdesc="Admin login successful" sn="1733486785" user="admin" ui="jsconsole" method="jsconsole" srcip=1.1.1.1 dstip=1.1.1.1 action="login" status="success" reason="none" profile="super_admin" msg="Administrator admin logged in successfully from jsconsole"

2.After the threat actors create an admin user, a log will be generated with what appears to be a randomly generated user name and source IP address:

type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="jsconsole(127.0.0.1)" action="Add" cfgtid=1411317760 cfgpath="system.admin" cfgobj="vOcep" cfgattr="password[*]accprofile[super_admin]vdom[root]" msg="Add system.admin vOcep"

     3.The security companies also warned that the attackers commonly used the following IP addresses in attacks:

• 1.1.1.1
• 127.0.0.1
• 2.2.2.2
• 8.8.8.8
• 8.8.4.4

4. Admin or Local user created by the TA is randomly generated. e.g:

• Gujhmk
• Ed8x4k
• G0xgey
• Pvnw81
• Alg7c4
• Ypda8a
• Kmi8p4
• 1a2n6t
• 8ah1t6
• M4ix9f

Solution :

  Fortinet also advised admins in today's advisory to disable the HTTP/HTTPS administrative interface or limit what IP addresses can reach the administrative interface

via local-in policies as a workaround.

The important things is Security systems. We must concern and monitor as usual.
For more information please contact
Email :sales@inetms.co.th
065 149 2822 (Ms.Suphatson )
063 204 4534 (Ms.Atsamaphorn)
065 929 6330 (Ms.Kansinee)
0613879439 (Ms.Sirilak)
0922576902 (Ms.Narusorn)

References :

• https://www.fortiguard.com/psirt/FG-IR-24-535
• https://www.bleepingcomputer.com/news/security/fortinet-warns-of-auth-bypass-zero-day-exploited-to-hijack-firewalls/
• https://app.opencve.io/cve/CVE-2024-55591
• https://nvd.nist.gov/vuln/detail/CVE-2024-55591
• https://www.tbpgroup.com/fortinet/

Weekly Interesting CVE

Ref:https://www.securityweek.com/emerging-funksec-ransomware-developed-using-ai/