Critical Fortinet Vulnerability Being Actively Exploited
Date of Notice: 12/13/2022
Action Level - Critical
Description
MCNC would like to ensure you are aware of FotiOS vulnerability that could permit a remote unauthenticated attack to execute code or commands on your device. These vulnerabilities are being actively exploited and you should verify your devices have been patched according to Fortinet’s guidance. This is being tracked as CVE-2022-42475.
Affected Devices
- FortiOS version 7.2.0 through 7.2.2
- FortiOS version 7.0.0 through 7.0.8
- FortiOS version 6.4.0 through 6.4.10
- FortiOS version 6.2.0 through 6.2.11
- FortiOS version 6.0.0 through 6.0.15
- FortiOS version 5.6.0 through 5.6.14
- FortiOS version 5.4.0 through 5.4.13
- FortiOS version 5.2.0 through 5.2.15
- FortiOS version 5.0.0 through 5.0.14
- FortiOS-6K7K version 7.0.0 through 7.0.7
- FortiOS-6K7K version 6.4.0 through 6.4.9
- FortiOS-6K7K version 6.2.0 through 6.2.11
- FortiOS-6K7K version 6.0.0 through 6.0.14
Attack Vector:
- Network, attacker sends crafted requests.
Attack Feasibility
This is actively being exploited, check device logs for the following Indicators of Compromise
Multiple log entries with:
- Logdesc="Application crashed" and msg="[...] application:sslvpnd,[...], Signal 11 received, Backtrace: [...]“
Presence of the following artifacts in the filesystem:
- /data/lib/libips.bak
- /data/lib/libgif.so
- /data/lib/libiptcp.so
- /data/lib/libipudp.so
- /data/lib/libjepg.so
- /var/.sslvpnconfigbk
- /data/etc/wxd.conf
- /flash
Connections to suspicious IP addresses from the FortiGate:
- 188.34.130.40:444
- 103.131.189.143:30080,30081,30443,20443
- 192.36.119.61:8443,444
- 172.247.168.153:8033
Mitigations
The only mitigation is to disable your SSL VPN
Remediations
Update to the versions specific in the vendor documentation below:
- Please upgrade to FortiOS version 7.2.3 or above
- Please upgrade to FortiOS version 7.0.9 or above
- Please upgrade to FortiOS version 6.4.11 or above
- Please upgrade to FortiOS version 6.2.12 or above
- Please upgrade to upcoming FortiOS-6K7K version 7.0.8 or above
- Please upgrade to FortiOS-6K7K version 6.4.10 or above
- Please upgrade to upcoming FortiOS-6K7K version 6.2.12 or above
- Please upgrade to FortiOS-6K7K version 6.0.15 or above
Vendor Resources
- Fortinet PSIRT Advisory - CVE-2022-42475 / FG-IR-22-398