Fortinet disclosed critical authentication bypass vulnerabilities in FortiOS, FortiProxy…
Fortinet disclosed critical authentication bypass vulnerabilities in FortiOS, FortiProxy, and FortiSwitchManager allowing unauthenticated remote attackers to perform arbitrary operations.
The Japan Information-technology Promotion Agency (IPA) issued an alert regarding authentication bypass vulnerabilities in Fortinet FortiOS, FortiProxy, and FortiSwitchManager products. The vulnerabilities allow unauthenticated remote attackers to send crafted HTTP or HTTPS requests to the management interface and perform arbitrary operations on affected systems.
Fortinet has confirmed active exploitation attempts in the wild, indicating these vulnerabilities are being weaponized by threat actors. The advisory emphasizes the urgency of implementing patches due to the observed attacks and the potential for widespread impact.
Fortinet has released patched versions and recommends either updating to the latest version or implementing workarounds including disabling HTTP/HTTPS administrative interface access or restricting access to trusted internal IP addresses only. Organizations should prioritize remediation given the combination of critical severity, remote exploitability without authentication, and confirmed in-the-wild exploitation.
Mentioned in this report
Detection guidance
FortiOS Admin Management Interface Accessed From External/WAN Interface
Detects traffic reaching the FortiOS/FortiProxy HTTP/HTTPS administrative interface from the WAN-facing interface, consistent with exploitation of unauthenticated management-interface auth bypass vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Admin Interface Reached From WAN Interface
id: 80b07db2-e707-527d-bad9-4fe55b786366
status: experimental
description: 'Detects firewall traffic logs where the FortiOS/FortiProxy/FortiSwitchManager
administrative HTTP/HTTPS interface (typically bound to the internal management
daemon on TCP 443/80 or a custom admin port) is reached from an external/WAN-facing
interface. This pattern is consistent with attempted exploitation of authentication
bypass vulnerabilities affecting the management interface where it should normally
only be reachable from trusted internal networks.
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
logsource:
category: firewall
product: fortios
detection:
selection:
dstport:
- 443
- 80
srcintf: wan1
action: accept
admin_service:
service|contains:
- HTTPS
- HTTP
- admin
filter:
srcip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and admin_service and not filter
falsepositives:
- Legitimate remote administration from an authorized management VPN terminated on
the WAN interface
- Misconfigured logging that tags internal management VLANs as WAN interface
level: medium
FortiOS Administrator Account Created or Modified Shortly After Management Interface Access
Detects creation or modification of local administrator accounts on FortiOS/FortiProxy devices, a common post-exploitation action following successful auth-bypass attacks against the management interface, used to establish persistent valid-account access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Local Administrator Account Created or Modified
id: 20353035-2a4d-5405-968c-7d42792702a6
status: experimental
description: 'Detects FortiOS/FortiProxy event logs indicating a local administrator
account
was created or modified. This is a known post-exploitation action after successful
exploitation of authentication bypass vulnerabilities on the management interface,
used by attackers to establish persistent valid-account access to the device.
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
category: application
product: fortios
detection:
selection:
logdesc|contains:
- Admin user added
- Administrator added
- Administrator updated
- User added
condition: selection
falsepositives:
- Legitimate administrative onboarding of new operators by IT staff
- Scheduled account rotation performed by change-management processes
level: high
SSH Public Key Added to FortiOS Administrator Account
Detects addition of an SSH public key to a local FortiOS administrator account, a persistence technique observed after exploitation of management interface authentication bypass vulnerabilities allowing attackers passwordless SSH access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH Public Key Added to FortiOS Admin Account
id: 097a1394-3e36-528a-a49e-686bb3503fc0
status: experimental
description: 'Detects log events showing an SSH public key being added or changed
for a local
administrator account on FortiOS/FortiProxy devices. Attackers exploiting
authentication-bypass vulnerabilities against the management interface have been
observed adding SSH public keys to admin accounts to gain persistent, passwordless
remote access to the device.
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
category: application
product: fortios
detection:
selection:
logdesc|contains:
- ssh-public-key
- SSH public key
- public-key set
condition: selection
falsepositives:
- Legitimate rollout of SSH key-based authentication by network administrators
- Automated configuration management tools rotating admin SSH keys
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/alert20221011.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free