# Fortinet disclosed critical authentication bypass vulnerabilities in FortiOS, FortiProxy…

Published: 2022-10-10 · Severity: critical
Canonical: https://vorant.io/reports/8256e433-751a-4c93-8132-44e408f1eca3/fortinet-disclosed-critical-authentication-bypass-vulnerabilities-in-fortios

> Fortinet disclosed critical authentication bypass vulnerabilities in FortiOS, FortiProxy, and FortiSwitchManager allowing unauthenticated remote attackers to perform arbitrary operations.

The Japan Information-technology Promotion Agency (IPA) issued an alert regarding authentication bypass vulnerabilities in Fortinet FortiOS, FortiProxy, and FortiSwitchManager products. The vulnerabilities allow unauthenticated remote attackers to send crafted HTTP or HTTPS requests to the management interface and perform arbitrary operations on affected systems.

Fortinet has confirmed active exploitation attempts in the wild, indicating these vulnerabilities are being weaponized by threat actors. The advisory emphasizes the urgency of implementing patches due to the observed attacks and the potential for widespread impact.

Fortinet has released patched versions and recommends either updating to the latest version or implementing workarounds including disabling HTTP/HTTPS administrative interface access or restricting access to trusted internal IP addresses only. Organizations should prioritize remediation given the combination of critical severity, remote exploitability without authentication, and confirmed in-the-wild exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)

## Detection guidance (public sample)

### FortiOS Admin Management Interface Accessed From External/WAN Interface

ATT&CK: T1190

Detects traffic reaching the FortiOS/FortiProxy HTTP/HTTPS administrative interface from the WAN-facing interface, consistent with exploitation of unauthenticated management-interface auth bypass vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS Admin Interface Reached From WAN Interface
id: 80b07db2-e707-527d-bad9-4fe55b786366
status: experimental
description: 'Detects firewall traffic logs where the FortiOS/FortiProxy/FortiSwitchManager

  administrative HTTP/HTTPS interface (typically bound to the internal management

  daemon on TCP 443/80 or a custom admin port) is reached from an external/WAN-facing

  interface. This pattern is consistent with attempted exploitation of authentication

  bypass vulnerabilities affecting the management interface where it should normally

  only be reachable from trusted internal networks.

  '
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
logsource:
  category: firewall
  product: fortios
detection:
  selection:
    dstport:
    - 443
    - 80
    srcintf: wan1
    action: accept
  admin_service:
    service|contains:
    - HTTPS
    - HTTP
    - admin
  filter:
    srcip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and admin_service and not filter
falsepositives:
- Legitimate remote administration from an authorized management VPN terminated on
  the WAN interface
- Misconfigured logging that tags internal management VLANs as WAN interface
level: medium
```

### FortiOS Administrator Account Created or Modified Shortly After Management Interface Access

ATT&CK: T1078

Detects creation or modification of local administrator accounts on FortiOS/FortiProxy devices, a common post-exploitation action following successful auth-bypass attacks against the management interface, used to establish persistent valid-account access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS Local Administrator Account Created or Modified
id: 20353035-2a4d-5405-968c-7d42792702a6
status: experimental
description: 'Detects FortiOS/FortiProxy event logs indicating a local administrator
  account

  was created or modified. This is a known post-exploitation action after successful

  exploitation of authentication bypass vulnerabilities on the management interface,

  used by attackers to establish persistent valid-account access to the device.

  '
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
  category: application
  product: fortios
detection:
  selection:
    logdesc|contains:
    - Admin user added
    - Administrator added
    - Administrator updated
    - User added
  condition: selection
falsepositives:
- Legitimate administrative onboarding of new operators by IT staff
- Scheduled account rotation performed by change-management processes
level: high
```

### SSH Public Key Added to FortiOS Administrator Account

ATT&CK: T1078

Detects addition of an SSH public key to a local FortiOS administrator account, a persistence technique observed after exploitation of management interface authentication bypass vulnerabilities allowing attackers passwordless SSH access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SSH Public Key Added to FortiOS Admin Account
id: 097a1394-3e36-528a-a49e-686bb3503fc0
status: experimental
description: 'Detects log events showing an SSH public key being added or changed
  for a local

  administrator account on FortiOS/FortiProxy devices. Attackers exploiting

  authentication-bypass vulnerabilities against the management interface have been

  observed adding SSH public keys to admin accounts to gain persistent, passwordless

  remote access to the device.

  '
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
  category: application
  product: fortios
detection:
  selection:
    logdesc|contains:
    - ssh-public-key
    - SSH public key
    - public-key set
  condition: selection
falsepositives:
- Legitimate rollout of SSH key-based authentication by network administrators
- Automated configuration management tools rotating admin SSH keys
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/alert20221011.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8256e433-751a-4c93-8132-44e408f1eca3/fortinet-disclosed-critical-authentication-bypass-vulnerabilities-in-fortios.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup