CVE-2022-40684: Critical Authentication Bypass in FortiOS and FortiProxy

Fortinet has patched a critical authentication bypass in its FortiOS and FortiProxy products that could lead to administrator access.

Background

On October 7, public reports began to circulate that Fortinet communicated directly with customers about a critical vulnerability in its FortiOS and FortiProxy products. This vulnerability, CVE-2022-40684, has been patched, but Fortinet has not released a full advisory yet via its Product Security Incident Response Team. 

Fortinet usually follows a monthly release schedule for security advisories on the second Tuesday of every month, the same day as Microsoft’s Patch Tuesday. At the time this blog post was originally published, it remained to be seen whether Fortinet was going to follow the same schedule for the CVE-2022-40684 advisory. The following tweet contains an image taken from the support page behind a login portal.

Update: By now the full text of the e-mail and a screenshot of the internal advisory have been shared.
So here goes a screenshot of the unredacted full e-mail as shared on Facebook. Also containing possible #workarounds.#Fortinet #CVE202240684 #RCE #authbypass #advisory pic.twitter.com/ruVmYhyXA5

— Gitworm (@Gi7w0rm) October 7, 2022

On October 10, Fortinet published its full advisory to the public that added FortiSwitchManager to the list of affected products.

Analysis

CVE-2022-40684 is a critical authentication bypass vulnerability that received a CVSSv3 score of 9.6. By sending specially crafted HTTP or HTTPS requests to a vulnerable target, a remote attacker with access to the management interface could perform administrator operations.

At the time of initial publication, there was no information on whether this vulnerability had been exploited in attacks. In the October 10 release, Fortinet did confirm that there has been “an instance” of exploitation in the wild. Given threat actors’ penchant for targeting FortiOS vulnerabilities, Fortinet’s recommendation to remediate this vulnerability “with the utmost urgency” is appropriate.

Proof of Concept

On October 13, Horizon 3.ai published a technical deep dive and proof-of-concept for CVE-2022-40684.

Solution

The table below maps the vulnerable and fixed version numbers for all affected products:

If you cannot apply patches immediately, Fortinet states that using a local-in-policy to limit access to the management interface. Fortinet also includes steps on disabling administrative access to the internet facing interface and steps on restricting access to trusted hosts in their FortiGate Hardening Guide. As the guide notes, these steps are part of their system administrator best practices.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released. This link uses a search filter to ensure that all matching plugin coverage will appear as it is released. Customers can also use Plugin ID 73522 to identify the version of Fortinet Devices in your network. Please note that the plugin does require providing SSH credentials for the Fortinet device.

Get more information

• Fortinet PSIRT advisory for CVE-2022-40684
• FortiOS release notes for 7.2.2
• FortiOS release notes for 7.0.7
• Fortinet PSIRT

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 30-day trial of Tenable.io Vulnerability Management.