Attack Chain

1. The attacker identifies a vulnerable Fortinet appliance exposed to the internet.
2. The attacker crafts a malicious HTTP request to the /api/v2/cmdb/system/admin endpoint, bypassing authentication checks.
3. The attacker uses the PUT or POST HTTP methods to modify existing administrator accounts or create new accounts.
4. The attacker adds an SSH key to an administrator account to gain persistent remote access.
5. The attacker uses the newly created or modified administrator account to log into the Fortinet appliance's web interface or SSH.
6. The attacker reconfigures firewall rules to allow unauthorized network traffic.
7. The attacker exfiltrates sensitive data from the network through the compromised Fortinet appliance.
8. The attacker uses the compromised appliance as a pivot point to access other internal systems.

Impact

Successful exploitation of CVE-2022-40684 can lead to complete compromise of the Fortinet appliance and the network it protects. Attackers can gain unauthorized access to sensitive data, disrupt network services, and use the compromised appliance as a foothold for further attacks within the network. This vulnerability has been widely exploited, impacting numerous organizations across various sectors. Unpatched systems are at high risk of being compromised.

Recommendation

• Apply the latest Fortinet patches to address CVE-2022-40684 on all FortiOS, FortiProxy, and FortiSwitchManager appliances immediately.
• Deploy the Sigma rule Fortinet Appliance Auth Bypass Attempt to your SIEM to detect exploitation attempts targeting the /api/v2/cmdb/system/admin endpoint.
• Enable web server logging on Fortinet appliances to ensure the Sigma rule can effectively detect malicious activity.
• Review existing user accounts and SSH keys for any unauthorized additions or modifications.
• Monitor network traffic for suspicious outbound connections originating from Fortinet appliances.
• Implement network segmentation to limit the impact of a successful breach.