FortiOS & FortiProxy - Authentication bypass in Node.js websocket module vulnerability

Kyaw_Myo_Oo — Wed, 15 Jan 2025 06:21:35 GMT

Dear all,

Fortinet has identified a critical vulnerability in FortiOS and FortiProxy. The vulnerability may allow an unauthenticated remote attacker to gain “super-admin” privileges.

The Fortinet vulnerability notification describes possible Indicators of Compromise (IOCs) and IPs associated the threat actor, which may assist in identifying suspicious activity.

Fortinet has observed active exploitation of this vulnerability.
Fortinet advises that threat actors have been observed performing the following post exploitation activities:
Creating an admin account on the device with a random user name.
Creating a Local User account on the device using a random name.
Creating a user group or adding the above local user to an existing sslvpn user group.
Adding/changing other settings (firewall policy etc.)
Logging in the sslvpn with the above-added local users to get a tunnel to the internal network.

Affected versions/applications:

FortiOS version 7.0 - 7.0.0 through 7.0.16
FortiProxy version 7.0 - 7.0.0 through 7.0.19
FortiProxy version 7.2 - 7.2.0 through 7.2.12

https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/fortios-fortiproxy-authentication-bypass-nodejs-websocket-module-vulnerability?utm_source=linkedin&utm_campaign=feb-25&utm_medium=social&utm_content=alert-fortinet

https://www.fortiguard.com/psirt/FG-IR-24-535

Re: FortiOS & FortiProxy - Authentication bypass in Node.js websocket module vulnerability

Danielll — Tue, 01 Apr 2025 03:29:55 GMT

Stay safe online, everyone! Fortinet's recent announcement about a critical vulnerability in FortiOS and FortiProxy is serious. Think of your network security like managing your own little store, but instead of bananas in Monkey Mart, it's sensitive data! Unpatched systems could grant attackers "super-admin" access, like giving them the keys to the whole kingdom. Be sure to check for those IOCs and apply the necessary updates immediately to avoid potential compromises.

topic Re: FortiOS & FortiProxy - Authentication bypass in Node.js websocket module vulnerability in Threats

FortiOS & FortiProxy - Authentication bypass in Node.js websocket module vulnerability

Re: FortiOS & FortiProxy - Authentication bypass in Node.js websocket module vulnerability