Symlink Exploit Enables Stealthy Persistence

The attackers exploited known vulnerabilities, including CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762, to create symlinks that connect the user file system to the root file system in directories serving SSL-VPN language files. These modifications, residing in the user file system, evade detection and persist even after patches are applied, granting attackers continued read-only access to sensitive configurations. ​

Mitigation Measures and Recommended Actions

Fortinet has released updates across multiple FortiOS versions to address this issue:​

• In FortiOS versions 7.4, 7.2, 7.0, and 6.4, the symlink is now flagged as malicious, enabling automatic removal by the antivirus engine.​
• In FortiOS versions 7.6.2, 7.4.7, 7.2.11, 7.0.17, and 6.4.16, the symlink is removed, and the SSL-VPN UI has been modified to prevent serving such malicious symlinks.​

Administrators are strongly advised to update to these versions, thoroughly review device configurations, and treat all configurations as potentially compromised. Appropriate recovery steps should be undertaken to ensure system integrity. ​

Global Security Agencies Issue Warnings

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an advisory urging users to reset exposed credentials and consider disabling SSL-VPN functionality until patches can be applied. Similarly, France’s Computer Emergency Response Team (CERT-FR) has acknowledged compromises dating back to early 2023, emphasizing the widespread nature of this threat.

Expert Insights on Evolving Threat Landscape

Benjamin Harris, CEO of cybersecurity firm watchTowr, highlighted the increasing speed at which attackers exploit vulnerabilities, often outpacing organizational patching efforts. He noted that attackers are deploying backdoors designed to survive standard remediation processes, including patching, upgrades, and factory resets, thereby maintaining persistent access to compromised systems.

Key Takeaways for FortiGate Users

• ​Update Immediately: Ensure FortiOS is updated to the latest patched versions.​
• ​Review Configurations: Conduct comprehensive reviews of device configurations for unauthorized changes.​
• ​Reset Credentials: Reset all potentially exposed credentials associated with the affected devices.​
• ​Consider Disabling SSL-VPN: If immediate patching isn’t feasible, temporarily disable SSL-VPN functionality to mitigate risk.​

The post Advanced Threat Actors Shift Focus to Firmware-Level Persistence on FortiGate Devices appeared first on CyberHood Sentinel.

Nature of the Vulnerability

The identified vulnerability is an unverified password change issue (CWE-620) within the FortiSwitch Graphical User Interface (GUI). This security gap allows remote, unauthenticated attackers to modify administrator passwords by sending specially crafted requests to the affected system. Such unauthorized access could lead to full administrative control over the device, posing significant risks to network integrity and security. ​

Affected FortiSwitch Versions

The vulnerability impacts the following FortiSwitch firmware versions:

• 7.6.0 (users should upgrade to 7.6.1 or later)​
• 7.4.0 through 7.4.4 (upgrade to 7.4.5 or later)​
• 7.2.0 through 7.2.8 (upgrade to 7.2.9 or later)​
• 7.0.0 through 7.0.10 (upgrade to 7.0.11 or later)​
• 6.4.0 through 6.4.14 (upgrade to 6.4.15 or later)​

Fortinet has released patches for these versions and strongly recommends that users update their devices promptly to mitigate potential risks. ​

Discovery and Reporting

This security flaw was internally discovered and reported by Daniel Rozeboom, a member of the FortiSwitch web UI development team. Fortinet has acknowledged his contribution in identifying and addressing this critical issue. ​

Recommended Mitigation Measures

In addition to applying the necessary firmware updates, Fortinet advises users to implement the following precautionary measures:​

1. Disable HTTP/HTTPS Access: Turn off HTTP/HTTPS access to administrative interfaces to reduce exposure to potential attacks.​
2. Restrict System Access: Limit system access to trusted hosts only, ensuring that only authorized devices can communicate with the FortiSwitch administrative interface.

These steps are essential in minimizing the attack surface and enhancing the overall security posture of the network. ​

Potential Risks and Exploitation

While there is currently no evidence to suggest that this vulnerability has been exploited in the wild, similar security flaws in Fortinet products have previously been targeted by threat actors. The critical nature of this vulnerability underscores the importance of immediate action to prevent unauthorized access and potential network compromise. ​

Conclusion

Fortinet’s prompt response to CVE-2024-48887 highlights the company’s commitment to maintaining the security and integrity of its products. Users and administrators are urged to review Fortinet’s official advisory, apply the recommended updates, and implement the suggested mitigation measures without delay. Proactive steps are crucial in safeguarding network infrastructure against potential threats and ensuring the continued reliability of FortiSwitch devices.​

For detailed information and access to the security updates, users should refer to Fortinet’s official Product Security Incident Response Team (PSIRT) advisory

The post Critical FortiSwitch Vulnerability (CVE-2024-48887) Prompts Urgent Firmware Updates from Fortinet appeared first on CyberHood Sentinel.

Discovery and Reporting

The cybersecurity firm Volexity identified this critical flaw earlier in the summer of 2024. They promptly reported the issue to Fortinet on July 18, 2024, receiving acknowledgment on July 24, 2024. Despite this, as of November 18, 2024, the vulnerability remains unpatched, and no Common Vulnerabilities and Exposures (CVE) identifier has been assigned. This delay in remediation leaves numerous organizations vulnerable to potential breaches.

The Exploitation Mechanism

The attackers, identified as the Chinese hacking group “BrazenBamboo,” have been leveraging a custom post-exploitation toolkit named ‘DeepData’ to exploit this zero-day vulnerability. DeepData is a modular tool designed to perform various malicious activities, including credential theft, data exfiltration, and system reconnaissance. By exploiting the FortiClient vulnerability, DeepData can access and extract VPN credentials from the application’s memory, granting attackers unauthorized access to secure networks.

Implications for Organizations

The exploitation of this vulnerability has severe implications for organizations using Fortinet’s VPN solutions. Unauthorized access to VPN credentials can lead to data breaches, unauthorized data access, and potential disruptions in business operations. The fact that this vulnerability remains unpatched months after its discovery exacerbates the risk, as attackers continue to exploit it in the wild.

Recommendations for Mitigation

While awaiting an official patch from Fortinet, organizations are advised to implement the following measures to mitigate the risk associated with this vulnerability:

1. Monitor Network Traffic: Regularly inspect network traffic for unusual patterns that may indicate unauthorized access or data exfiltration attempts.
2. Implement Multi-Factor Authentication (MFA): Enhance security by requiring multiple forms of verification for VPN access, reducing the risk of credential-based attacks.
3. Restrict VPN Access: Limit VPN access to essential personnel and ensure that access rights are regularly reviewed and updated.
4. Educate Employees: Conduct training sessions to raise awareness about phishing attacks and other social engineering tactics that attackers may use to gain initial access.
5. Stay Informed: Keep abreast of updates from Fortinet regarding this vulnerability and apply patches promptly once they are released.

Fortinet’s Response

As of the latest reports, Fortinet has acknowledged the vulnerability but has not yet released a patch or assigned a CVE identifier. The cybersecurity community urges Fortinet to expedite the development and deployment of a fix to protect its users from ongoing exploitation.

Broader Context

This incident is part of a broader trend of state-sponsored cyber-espionage activities targeting critical infrastructure and private organizations worldwide. Chinese hacking groups have been implicated in several high-profile attacks, including breaches of government networks and critical infrastructure sectors. The exploitation of zero-day vulnerabilities in widely used software underscores the need for robust cybersecurity practices and timely patch management.

Conclusion

The exploitation of a zero-day vulnerability in Fortinet’s FortiClient Windows VPN client by Chinese threat actors highlights the persistent and evolving nature of cyber threats. Organizations must remain vigilant, implement proactive security measures, and stay informed about emerging vulnerabilities to protect their networks and sensitive data. The cybersecurity community continues to advocate for prompt disclosure and remediation of vulnerabilities to mitigate the risks posed by such sophisticated attacks.

The post Chinese Hackers Exploit Fortinet VPN Zero-Day: A Wake-Up Call for Cybersecurity appeared first on CyberHood Sentinel.