Fortinet auth bypass CVE-2022-40684 exploited

10 October 2022 critical vulnerability technologyinfrastructure

An authentication bypass flaw in FortiOS, FortiProxy, and FortiSwitchManager is being actively exploited to let remote attackers issue arbitrary admin commands.

Fortinet disclosed an authentication bypass vulnerability affecting FortiOS, FortiProxy, and FortiSwitchManager that allows an unauthenticated remote attacker to send specially crafted HTTP or HTTPS requests to the management interface, potentially resulting in arbitrary administrative operations on the device. IPA (Japan's information security agency) reports that attacks believed to exploit this vulnerability have already been observed in the wild.

Given the administrative-level access these devices provide into enterprise networks, exploitation could lead to full compromise of affected security appliances, enabling further lateral movement or persistence. IPA urges affected organizations to apply Fortinet's patched versions immediately or implement the vendor's recommended workarounds, given the risk of expanding attacks.

Mentioned in this report

Vulnerabilities CVE-2022-40684KEV

Detection guidance

FortiOS Admin API Access With Spoofed Forwarded/X-Forwarded-For Header (CVE-2022-40684)

ATT&CK T1190

Detects HTTP requests to FortiOS/FortiProxy management API paths containing a Forwarded or X-Forwarded-For header claiming a loopback/trusted origin (e.g. for=127.0.0.1), the known technique used to bypass authentication for CVE-2022-40684. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: FortiOS Admin API Access With Spoofed Forwarded Header
id: cd2a3d1a-0214-5b3b-9e5a-201b4474ccaf
status: experimental
description: Detects HTTP requests to FortiOS/FortiProxy administrative API endpoints
  where the Forwarded or X-Forwarded-For header claims a loopback or internal trusted
  address, the technique used to bypass authentication in CVE-2022-40684.
references:
- https://www.fortiguard.com/psirt/FG-IR-22-377
logsource:
  category: proxy
  product: generic
detection:
  selection_path:
    cs-uri-stem|contains:
    - /api/v2/cmdb/system/admin
    - /api/v2/cmdb/
  selection_header:
    cs-header|contains:
    - 'Forwarded: for=127.0.0.1'
    - Forwarded:for=127.0.0.1
    - 'X-Forwarded-For: 127.0.0.1'
    - 'Forwarded: for=localhost'
  filter_internal_proxy:
    c-ip|startswith:
    - '10.'
    - 192.168.
    - 172.16.
  condition: selection_path and selection_header and not filter_internal_proxy
  falsepositives:
  - Internal load balancers or reverse proxies legitimately rewriting Forwarded headers
    for health checks
  - Misconfigured internal monitoring tools that set loopback addresses in forwarding
    headers
  level: high
  tags:
  - attack.t1190
  - attack.initial_access
author: Vorant

FortiOS Admin Account Modification via API from External Source (CVE-2022-40684 Exploitation)

ATT&CK T1190

Detects PUT/POST requests to the FortiOS system/admin CMDB API which can be used post-authentication-bypass to add SSH keys or modify administrator accounts, indicating exploitation of the management interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: FortiOS System Admin Object Modification via API
id: 87726f9f-389b-5342-b90b-ce4c815da171
status: experimental
description: Detects HTTP PUT or POST requests to FortiOS/FortiProxy /api/v2/cmdb/system/admin
  endpoint, used to create or modify administrator accounts (e.g. adding SSH keys)
  after successful authentication bypass via CVE-2022-40684.
references:
- https://www.fortiguard.com/psirt/FG-IR-22-377
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method:
    - PUT
    - POST
    cs-uri-stem|contains: /api/v2/cmdb/system/admin
  filter_authenticated_admin_ui:
    cs-uri-query|contains: access_token=
  condition: selection and not filter_authenticated_admin_ui
  falsepositives:
  - Legitimate administrative automation or scripts managing admin accounts through
    the documented, authenticated REST API with valid access tokens
  level: medium
  tags:
  - attack.t1190
  - attack.persistence
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/alert20221011.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free