Fortinet’s Patched Critical Flaw: Unveiling Potential Exploitation

Attackers Exploit Flaw in Fortinet‘s FortiOS SSL-VPN

A recently discovered vulnerability in Fortinet‘s FortiOS SSL-VPN has left users in government, manufacturing, and critical infrastructure sectors vulnerable to potential attacks. The flaw, identified as CVE-2023-27997 / FG-IR-23-097, has been rated as critical due to the potential for data loss, OS and file corruption for victims. Fortinet has issued a fix for the vulnerability and urges its customers to apply the patch to mitigate the risk. Immediate action is recommended for customers with SSL-VPN enabled, but even for those without, upgrading is still strongly recommended. The patch addresses a heap-based buffer overflow, pre-authentication vulnerability that affects FortiOS and FortiProxy SSL-VPN, and could allow unauthenticated attackers to gain remote code execution (RCE) through malicious requests.

Importance of Applying the Patch

Fortinet‘s patch aims to address the critical vulnerability in their SSL-VPN platform. Failure to update systems can have severe consequences, including data loss and corruption. It is essential for affected customers to prioritize updating their firmware to ensure adequate protection against potential attacks. Furthermore, Fortinet‘s recommendation for all customers, even those without SSL-VPN enabled, to upgrade underscores the importance of staying proactive in maintaining system security.

Potential Links to the Volt Typhoon Campaign

Although attackers in the recent Volt Typhoon campaign utilized a previously identified Fortinet vulnerability (CVE-2022-40684 / FG-IR-22-377) against critical infrastructure targets in the US, Fortinet has not definitively linked it to the CVE-2023-27997 vulnerability discussed earlier. However, Fortinet acknowledges that this does not eliminate the possibility of the current campaign exploiting the new vulnerability or attackers leveraging it in future attacks. Fortinet anticipates threat actors, including those behind the Volt Typhoon campaign, to continue exploiting unpatched vulnerabilities in widely used software and devices.

The Threat of the Volt Typhoon Campaign

The Volt Typhoon campaign, discovered by Microsoft, involves China-sponsored threat actors gaining persistent access within US telecom networks and other critical infrastructure targets. The attackers initially exploited the previously identified CVE-2022-40684 vulnerability in Fortinet FortiOS and FortiProxy to gain entry. Fortinet researchers have found admin accounts related to the Volt Typhoon campaign in customer devices, evidencing the campaign’s connection to Fortinet products. The campaign utilizes various tactics, techniques, and procedures (TTPs), including the use of “living off the land” techniques to evade detection.

Importance of Patching and Additional Mitigations

Patching vulnerabilities promptly remains the primary method to mitigate the risk of exploitation. Fortinet recommends that affected organizations also review systems to identify any evidence of previous Fortinet vulnerabilities exploited, such as those used in the Volt Typhoon campaign. Additionally, minimizing the attack surface by disabling unused features and managing devices through an out-of-band method can further protect organizations from being targeted by attacks that exploit existing vulnerabilities.

Conclusion and Recommendations

With the growing number of cyber threats and the potential for severe consequences, it is crucial for individuals and organizations to remain vigilant and proactive in protecting their systems. Applying patches and updates promptly, especially for critical vulnerabilities, is essential in maintaining security. Additionally, regular audits and reviews of systems for evidence of exploitation are recommended. It is also important to adopt best practices, such as minimizing attack surfaces and managing devices securely, to further mitigate risks. As threat actors continue to exploit vulnerabilities in widely used software and devices, it is imperative that users and organizations prioritize cybersecurity and take the necessary steps to ensure their systems are secure.