Dive Brief:
-
Fortinet detailed new exploitation activity against known critical vulnerabilities in FortiGate devices, including CVE-2022-42475, CVE-2023-27997 and CVE-2024-21762, in a Thursday blog post..
-
Fortinet said that although these vulnerabilities have been patched, a threat actor was observed using a new technique to maintain read-only access to vulnerable FortiGate devices after they were updated.
-
Fortinet vulnerabilities have been heavily targeted by a range of attackers in recent years as both cybercriminals and nation-state threat groups shifted focus to edge devices as initial access vectors.
Dive Insight:
Fortinet CISO Carl Windsor warned that a recent investigation into active exploitation of the older CVEs revealed that a threat actor was using a novel technique that allowed them to read files and data on Fortinet devices that were patched. This was achieved by creating a "symbolic link" between the user file systems and the root file systems via a folder that serves language files for SSL-VPNs.
"This modification took place in the user filesystem and avoided detection," Windsor wrote in the blog post. "Therefore, even if the customer device was updated with FortiOS versions that addressed the original vulnerabilities, this symbolic link may have been left behind, allowing the threat actor to maintain read-only access to files on the device's file system, which may include configurations."
The Cybersecurity and Infrastructure Security Agency on Friday issued a security alert regarding the exploitation activity and encouraged organizations to implement mitigations.
Telemetry based on Fortinet scans and input from third-party organizations showed the exploitation activity was not focused on a specific region or industry, Windsor said.
Fortinet released several mitigations to address the new technique. In FortiOS versions 7.4, 7.2, 7.0 and 6.4, the operating system's antivirus and intrusion prevention system engine automatically detects and removes the symbolic link. The network security vendor urged customers to upgrade all devices to versions 7.6.2, 7.4.7, 7.2.11 and 7.0.17 or 6.4.16, which remove existing symbolic links in Fortinet devices and prevent other malicious symbolic links from being served in the future.
