Fortinet authentication bypass flaw enables device takeover
Take action: If you are using FortiManager to manage Fortinet devices, make sure they are isolated from the internet and accessible only from trustef network. Communicate this flaw and the risk of phishing attempts to all admins. Finally, plan a patch process, which may be complex.
Learn More
Fortinet has patched a peculiar authentication bypass vulnerability affecting multiple enterprise security products.
The vulnerability is tracked as CVE-2024-26009 (CVSS score 7.9) - Authentication Bypass Using an Alternate Path or Channel in the The FortiGate-to-FortiManager (FGFM) protocol, designed for secure communication between FortiGate devices and central management systems. Attackers can craft malicious FGFM requests to target devices managed by FortiManager systems if they know the FortiManager's serial number.
The specific requirements of the exploit provides a very targeted channel of exploit - only systems where Fortinet systems are managed by FortiManager and:
- Disgruntled employees with knowledge of the respective serial number of the FortiManager system.
- Social engineering attacks that will persuade someone to give out the serial number of the FortiManager system.
Once these conditions are met, attackers can gain administrative-level access to the targeted infrastructure.
Affected products:
- FortiOS versions 6.4.0 through 6.4.15, 6.2.0 through 6.2.16 and all FortiOS 6.0 versions;
- FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, and 7.0.0 through 7.0.15;
- FortiPAM all versions in 1.2, 1.1, and 1.0 branches;
- FortiSwitchManager versions 7.2.0 through 7.2.3 and 7.0.0 through 7.0.3
Fortinet has provided remediation paths for each affected product:
- FortiOS 6.4 users should upgrade to version 6.4.16 or above,
- FortiOS 6.2 users should upgrade to 6.2.17 or above
- FortiOS 6.0 usermust migrate to a new release
- FortiProxy users must update to versions 7.0.16, 7.2.9, or 7.4.3, depending on their current installation
- FortiProxy 7.4.0 through 7.4.2 users should upgrade to version 7.4.3 or above,
- FortiProxy 7.2.0 through 7.2.8 users should update to 7.2.9 or above.
- FortiProxy 7.0.0 through 7.0.15 should upgrade to 7.0.16 or above.
- Legacy FortiPAM versions 1.0, 1.1, and 1.2 require complete migration to newer releases
- FortiSwitchManager 7.2.0 through 7.2.3 users should upgrade to 7.2.4 or above,
- FortiSwitchManager 7.0.0 through 7.0.3 should upgrade to 7.0.4 or above.
Naturally, proper isolation of the communication protocol is a first priority, as well as education of all administrators on risks of social engineering.
