Critical Fortinet vulnerability finds zero-day RCE exploits – Source: www.csoonline.com

Hackers in the wild are actively exploiting a critical vulnerability in Fortinet’s software management platform FortiManager, the company warned its users on Wednesday.

The bug, tracked as CVE-2024-47575, has been assigned a CVSS score of 9.8 out of 10, and is described as a “missing authentication for critical function” vulnerability allowing attackers to execute arbitrary code or commands via specially crafted requests.

“Reports have shown this vulnerability to be exploited in the wild,” the company said in an advisory, confirming zero-day exploitations.

Concurrently, the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

Exfiltrating managed device credentials

The advisory noted that the exploitation was observed to be limited to extracting data from managed devices for the moment.

“The identified actions of this attack in the wild have been to automate via a script the exfiltration of various files from the FortiManager which contained the IPs, credentials, and configurations of the managed devices,” Fortinet said.

In its preliminary research, Fortinet has found no evidence or reports of any low-level system installation of malware or backdoors on the compromised systems, according to the advisory.

“To the best of our knowledge, there have been no indicators of modified databases, or connections and modifications to the managed devices,” Fortinet added.

The affected FortiManager versions include FortiManager 6.2, 6.4,7.0,7.2, 7.4, and 7.6 which have been fixed in their respective subsequent releases. Additionally, FortiManager Cloud versions 6.4, 7.0, 7.2, and 7.4 are affected with fixes in their subsequent versions, with the exception of 6.4 which has all of its releases affected.

Feared nation-state exploitations

Online chatter suggests the software vendor has been aware of the flaw for at least a few days. On October 18, Reddit users discussed a FortiManager release that was allegedly rolled out without any “resolved issues” notes.

One user wrote, “There is a known vulnerability that has been privately disclosed to customers that affects up to 7.2.7. 7.2.8 should fix this. We received notice from Fortinet on 10/15. Public notice is coming per their email.” Fortinet’s advisory on CVE-2024-47575 says versions 7.2 through 7.2.7 were affected.

Additionally, cybersecurity researcher Kevin Beaumont has been tracking the same vulnerability as “Fortijump” for days, calling out Fortinet for not disclosing it publicly. “FortiJump FortiManager vulnerability is used by nation-state in espionage via MSPs,” Beaumont said in his blog.

Fortinet vulnerabilities have been a centre-point of nation-state exploitations with the company warning in February about a number of Fortinet bugs being used by China-backed threat actor, Volt Typhoon for cyber espionage.