According to the popular next-generation Firewall brand Fortigate Fortinet, a significant FortiOS SSL VPN vulnerability that was fixed in June 2023, might have been used in attacks against organisations involved in manufacturing, vital infrastructure, and the government. The news has alarmed cybersecurity experts in Australia, as well as the Australian Cyber Security Centre (ACSC).
Overview of Vulnerabilities Found in Fortinet Firewalls
CVE-2023-27997 was discovered during a code audit of the SSL-VPN module following another recent round of assaults on government entities that utilised the FortiOS SSL-VPN zero-day vulnerability CVE-2022-42475. When SSL-VPN is enabled, it has been discovered in several Fortinet Fortigate device versions.
Fortinet has rolled out information about the vulnerability that exploiting a URL parameter might cause a heap-based buffer overflow issue, also known as CVE-2023-27997 or FG-IR-23-097, in FortiOS and FortiProxy SSL-VPN. This will permit the execution of arbitrary code and allow unauthenticated attackers to execute remote code (RCE) through maliciously crafted requests.
Requests during the SSL-VPN pre-authentication stage are impacted by the vulnerability.
Following another recent round of attacks on government organisations that made use of the FortiOS SSL-VPN zero-day vulnerability CVE-2022-42475, CVE-2023-27997 was found during a code audit of the SSL-VPN module. It has been identified in multiple versions of Fortinet FortiGate devices when SSL-VPN is enabled.
Fortigate is a commonly used Next-Generation Firewall device. It is a network security appliance brand developed by Fortinet.
Fortigate specialises in providing security solutions for networks, including firewalls, intrusion prevention systems (IPS), virtual private networks (VPN), anti-virus, web filtering, and other security features.
Fortigate devices are commonly used in enterprise environments, data centers, and branch offices to secure network traffic and enforce security policies. They are known for their robustness, scalability, and ability to handle high network traffic volumes.
Mitigation advice for Australian Businesses
Australian businesses using Fortigate hardware ought to check their patch status and upgrade to the newest version.
Affected Products
Below given is the list of affected products at least:
- 7.2.0 through 7.2.4
- 7.0.0 through 7.0.11
- 6.4.0 through 6.4.12
- 6.2.0 through 6.2.13
- 6.0.0 through 6.0.16
Solutions
- Please upgrade to FortiOS version 7.4.0 or a higher version.
- Please upgrade to FortiOS version 7.2.5 or a higher version.
- Please upgrade to FortiOS version 7.0.12 or a higher version.
- Please upgrade to FortiOS version 6.4.13 or a higher version.
- Please upgrade to FortiOS version 6.2.14 or a higher version.
- Please upgrade to FortiOS version 6.0.17 or a higher version.
Workaround
For products running the impacted FortiOS versions, disable SSL-VPN.
Anitech and ACSC can help
The Australian Cyber Security Centre has not got any updates about the Fortigate Firewall vulnerability from Australian organisations.
However, in case you are one of those affected firms, you should update systems with the available patches, and analyse for areas that amounted to this compromise. They should inform ACSC immediately about the exploitation.
Furthermore, organisations can take assistance from expert information security consultants like the ones from Anitech.
Call us today at 1300 802 163 or e-mail – sales@anitechgroup.com
Recent Comments