Remote Code Execution vulnerability in Fortinet SSL VPN service

Fortinet is aware of at least one case where this vulnerability has been successfully exploited, although other unknown cases may certainly exist.

One exploits a vulnerability to deploy malicious files on the file system of affected devices.

Moreover, as seen in a recent campaign affecting Fortinet appliances (CVE-2022-40684), attackers can execute remote code in Fortinet appliances to achieve any of the following objectives:

• Opening and downloading the device configuration file
• This includes and is not exclusive to cleartext rules, policies, filtering, usernames, routing configurations and encrypted passwords (encrypted via the private encryption key).
• Creating privileged administrator accounts
• Uploading and running scripts

Potential for widespread exploitation

According to CISA's Known Exploited Vulnerabilities Catalog, threat actors have historically used similar Fortinet vulnerabilities to gain initial access and move laterally within an organisation's environment.

We therefore also assume that hackers will continue to actively exploit this vulnerability in the short term to gain access to sensitive information, such as the device configuration file.

This is thanks to the ease of exploitation, the potential for payload and execution and the prevalence of affected Fortinet devices within enterprise environments.