Fortinet auth bypass CVE-2022-40684 exploited
An authentication bypass flaw in FortiOS, FortiProxy, and FortiSwitchManager is being actively exploited to let remote attackers issue arbitrary admin commands.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2022-40684 as exploited in the wild.
Fortinet disclosed an authentication bypass vulnerability affecting FortiOS, FortiProxy, and FortiSwitchManager that allows an unauthenticated remote attacker to send specially crafted HTTP or HTTPS requests to the management interface, potentially resulting in arbitrary administrative operations on the device. IPA (Japan's information security agency) reports that attacks believed to exploit this vulnerability have already been observed in the wild.
Given the administrative-level access these devices provide into enterprise networks, exploitation could lead to full compromise of affected security appliances, enabling further lateral movement or persistence. IPA urges affected organizations to apply Fortinet's patched versions immediately or implement the vendor's recommended workarounds, given the risk of expanding attacks.
Mentioned in this report
Detection guidance
FortiOS Admin Account Modification via API from External Source (CVE-2022-40684 Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects PUT/POST requests to the FortiOS system/admin CMDB API which can be used post-authentication-bypass to add SSH keys or modify administrator accounts, indicating exploitation of the management interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS System Admin Object Modification via API
id: 87726f9f-389b-5342-b90b-ce4c815da171
status: experimental
description: Detects HTTP PUT or POST requests to FortiOS/FortiProxy /api/v2/cmdb/system/admin
endpoint, used to create or modify administrator accounts (e.g. adding SSH keys)
after successful authentication bypass via CVE-2022-40684.
references:
- https://www.fortiguard.com/psirt/FG-IR-22-377
logsource:
category: webserver
detection:
selection:
cs-method:
- PUT
- POST
cs-uri-stem|contains: /api/v2/cmdb/system/admin
filter_authenticated_admin_ui:
cs-uri-query|contains: access_token=
condition: selection and not filter_authenticated_admin_ui
author: Vorant
level: medium
tags:
- attack.t1190
- attack.persistence
falsepositives:
- Legitimate administrative automation or scripts managing admin accounts through
the documented, authenticated REST API with valid access tokens
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/alert20221011.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs