#fortimanager — Public Fediverse posts

A coordinated brute-force campaign has targeted Fortinet SSL VPNs, over 780 unique IPs launched credential attacks on August 3, followed by a change of target from FortiOS to FortiManager.

Read: https://hackread.com/brute-force-campaign-fortinet-ssl-vpn-coordinated-attack/

#Cybersecurity #Fortinet #BruteForce #CyberAttack #FortiOS #FortiManager

Hop-Skip-FortiJump-FortiJump-Higher - Fortinet FortiManager CVE-2024-47575

"The low complexity of these #vulnerabilities brings into question the overall quality of the #FortiManager codebase...
As far as we can make out, Fortinet just patched a chunk of irrelevant (dead?) code and left the actual #vulnerability alone, wide open for attackers."
https://labs.watchtowr.com/hop-skip-fortijump-fortijumphigher-cve-2024-23113-cve-2024-47575/

Full Rapid7 analysis and #exploit PoC (with root shell!) for #FortiManager #CVE202447575 via @stephenfewer 🐚 Not a simple project, as it turned out :) https://attackerkb.com/topics/OFBGprmpIE/cve-2024-47575/rapid7-analysis

...et ce n'est pas fini!

watchTowr fait le "teasing" sur le bad site de leur prochaine publication en conseillant carrément au détenteurs de Foritmanager exposé: "S'il vous plaît, retirez le d'Internet *même s'il est entièrement corrigé"

Le correctif pour la vulnérabilité « FortiJump » dans la plateforme de gestion FortiManager de Fortinet pourrait ainsi ne pas avoir complètement résolu le problème. Malgré une mise à jour récente, des preuves montrent que la vulnérabilité CVE-2024-47575 est encore exploitable, ce qui expose potentiellement 62 000 instances de FortiManager connectées à Internet selon Cyble threat intelligence.
⬇️
"FortiManager May Still Be Vulnerable Despite ‘FortiJump’ Patch
The FortiJump vulnerability in Fortinet FortiManager may not have been completely fixed by last month's patch. Users are urged to apply mitigations."
👇
https://thecyberexpress.com/fortimanager-vulnerable-fortijump-patch/

#CyberVeille
#CVE_2024_47575
#Fortinet #FortiJump #Fortimanager

FortiManager May Still Be Vulnerable Despite ‘FortiJump’ Patch https://thecyberexpress.com/fortimanager-vulnerable-fortijump-patch/ #vulnerabilitiesinFortinet #TheCyberExpressNews #ThreatIntelligence #TheCyberExpress #Vulnerabilities #FirewallDaily #cybersecurity #Vulnerability #FortiManager #Cyberattack #CyberNews #FortiJump #Fortinet

🚨CERT ALERT: FortiManager critical 0-day vulnerability exploited in the wild.

It's been discussed off the record since the time of release earlier last week. 🤫

The threat level of this advisory is thus considered very high (5/5, maximum severity level).📈🚨

👉🤓Read Orange CyberDefense’s detailed World Watch Advisory to learn more: https://ow.ly/Wai430sHtfk

#fortimanager
#vulnerabilitymanagement #cybersecurity

UNC5820 Exploits FortiManager Zero-Day Vulnerability (CVE-2024-47575) – Source:hackread.com https://ciso2ciso.com/unc5820-exploits-fortimanager-zero-day-vulnerability-cve-2024-47575-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #Vulnerability #CyberAttacks #FortiManager #CyberAttack #Fortinet #Hackread #security #UNC5820

UNC5820 Exploits FortiManager Zero-Day Vulnerability (CVE-2024-47575) https://hackread.com/unc5820-exploits-fortimanager-zero-day-vulnerability/ #Cybersecurity #Vulnerability #CyberAttacks #FortiManager #CyberAttack #Security #Fortinet #UNC5820

Kwetsbaarheid ontdekt in Fortinet FortiManager.
https://advisories.ncsc.nl/advisory?id=NCSC-2024-0423
#cybersecurity #fortinet #fortimanager #NCSC-2024-0423

❗️ #CERTWarnung ❗️
In #FortiManager von Fortinet wurde eine Zero-Day #Schwachstelle geschlossen, die seit Juni ausgenutzt wird. Eine Kompromittierung ist zu prüfen. Kunden sollten unverzüglich ihre Geräte absichern. #PatchNow
https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2024/2024-282848-10Ub2.html

https://www.fortiguard.com/psirt/FG-IR-24-423

„A missing authentication for critical function vulnerability [CWE-306] in FortiManager fgfmd daemon may allow a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.“

Patch & establish micro-segmentation (only dedicated sources should be able to access FortiManager (and everything else); Use e.g. private-vlans & tighten your acls/firewall-policies)

#infosec #fortinet #fortimanager

Fortinet Confirms Zero-Day Exploit Targeting FortiManager Systems https://www.securityweek.com/fortinet-confirms-zero-day-exploit-targeting-fortimanager-systems/ #Malware&Threats #NetworkSecurity #FortiManager #Fortinet #CISAKEV #ZeroDay

Fortinet Confirms Zero-Day Exploit Targeting FortiManager Systems https://www.securityweek.com/fortinet-confirms-zero-day-exploit-targeting-fortimanager-systems/ #Malware&Threats #NetworkSecurity #FortiManager #Fortinet #CISAKEV #ZeroDay

The Reddit threads on this have been something. Advisory and CVE finally available for the #FortiManager 0day that's been knocking around social media, trust circles, and customer email inboxes for a week+ now. Since exploitation has evidently been ongoing for a while, patching alone may not be enough — Fortinet has a bunch of IOCs and recovery directions in their advisory, so check those out. Would also strongly recommend relying directly on the vendor advisory for affected/fixed versions, as we have seen these expand, sometimes significantly, for some prior Fortinet vulns.

https://www.rapid7.com/blog/post/2024/10/23/etr-fortinet-fortimanager-cve-2024-47575-exploited-in-zero-day-attacks/

Advisory (assuming the PSIRT page stays up today!): https://www.fortiguard.com/psirt/FG-IR-24-423

@GossiTheDog Around 700 to 1100 FortiManagers are internet facing. That should be changed to 0. Only dedicated source ip addresses like hardened closely monitored jump servers should have access to FortiManagers/Firewall mgmt interfaces.

https://www.shodan.io/search?query=fortinet+fmg

https://www.shodan.io/search?query=mapserver.fortinet.com+http.favicon.hash%3A945408572

#infosec #fortinet #fortimanager

Patch your FortiManager now. Limit access to it to only from dedicated jump-servers.

#fortinet #fortimanager #infosec

Happy Patch Tuesday from your friends at Fortinet. 13 security advisories, 15 vulnerabilities. No mention of exploitation in the wild:

• FG-IR-23-087 CVE-2023-45590 (9.6 critical) [FortiClient Linux] Remote Code Execution due to dangerous nodejs configuration
• FG-IR-23-345 CVE-2023-45588 and CVE-2024-31492 (8.2 high) FortiClientMac - Lack of configuration file validation
• FG-IR-23-419 CVE-2023-47542 (6.7 medium) FortiManager - Code Injection via Jinja Template
• FG-IR-23-288 CVE-2023-48785 (4.8 medium) FortiNAC-F - Lack of certificate validation
• FG-IR-23-413 CVE-2023-48784 (6.7 medium) FortiOS - Format String in CLI command
• FG-IR-23-224 CVE-2024-23662 (5.3 medium ) FortiOS - Web server ETag exposure
• FG-IR-23-493 CVE-2023-41677 (7.5 high) FortiOS & FortiProxy - administrator cookie leakage
• FG-IR-23-454 CVE-2024-23671 (8.1 high) FortiSandbox - Arbitrary file delete on endpoint
• FG-IR-24-060 CVE-2024-31487 (5.9 medium) FortiSandbox - Arbitrary file read on endpoint
• FG-IR-23-416 CVE-2023-47541 (6.7 medium) FortiSandbox - Arbitrary file write on CLI leading to arbitrary code execution
• FG-IR-23-411 CVE-2023-47540 (6.7 medium) FortiSandbox - Command injection impacting CLI command
• FG-IR-23-489 CVE-2024-21755 and CVE-2024-21756 (8.8 high) FortiSandbox - OS command injection on endpoint
• FG-IR-24-009 CVE-2024-26014 (5.3 medium) SMTP Smuggling (analyst note: third party vulnerability)

#PatchTuesday #Fortinet #FortiManager #vulnerability #FortiSandbox #FortiOS #FortiProxy

CLI commands to check if your fortigate is vulnerable to "CVE-2022-42475":

```
fnsysctl ls /data/lib
fnsysctl ls /data/var
```

#fortigate #fortimanager #infosec #netsec #firewall #fortinet​

Credit:
https://ioc.exchange/@dantemercurio/109515426331770288

Here are the CLI commands to check for the file artifacts on a #fortigate to determine if your system was affected by the vulnerability in CVE-2022-42475:
fnsysctl ls /data/lib
fnsysctl ls /data/var
These were not documented in the PSIRT. You can run them directly on the fortigate, script them through a #fortimanager or through the cloud management console.
#infosec #netsec #firewall #fortinet