A critical authentication bypass vulnerability tracked as CVE-2022-40684 exists in FortiGate firewalls and FortiProxy web proxies. According to Fortinet, the vulnerability can allow an attacker to log into the vulnerable devices and perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
CVE-2022-40684 impacts the following versions:
Fortinet has since addressed the issue and has released patches for FortiOS and FortiProxy versions 7.0.7 or 7.2.2. This week, Fortinet privately warned their customers about the vulnerability and provided a workaround for those who cannot immediately patch. Although more than 100,000 FortiGate firewalls are reachable from the Internet, it is unknown if their management interfaces are exposed.
However, the cyber security company advises that it is best that all customers with vulnerable versions patch immediately due to the ability to exploit CVE-2022-40684 remotely. Fortinet stated the company delayed a public statement regarding the flaw because they wanted to wait until their customers applied the proper fixes. Fortinet has not commented on whether or not the vulnerability has been exploited in the wild.
Avertium recommends that your organization apply the appropriate patches for CVE-2022-40684.
If you are unable to patch, the company has issued a workaround:
INDICATOR'S OF COMPROMISE (IOCS):
At this time, there are no known IoCs associated with CVE-2022-40684. Avertium’s threat hunters remain vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.
Related Reading: Everything You Need to Know About Bumblebee Ransomware