watchTowr Finds New Zero-Day Vulnerability in Fortinet Products

Assault floor administration supplier watchTowr claims to have discovered a brand new zero-day vulnerability in cybersecurity supplier Fortinet’s merchandise.

This flaw would permit a managed FortiGate gadget to raise privileges and seize management of the FortiManager occasion.

This new vulnerability is much like a earlier flaw found in October, CVE-2024-47575, often known as “FortiJump.” Researchers at watchTowr named it “FortiJump Larger.”

Background on FortiJump

FortiJump, or CVE-2024-47575, is a vulnerability in FortiManager, a Fortinet instrument utilized by gadget directors to keep up complete fleets of FortiGate home equipment.

Extra particularly, FortiJump is the results of a lacking authentication for a essential perform (CWE-306) within the FortiManager fgfmd daemon that permits a distant unauthenticated attacker to execute arbitrary code or instructions by way of specifically crafted requests.

It permits risk actors to make use of a compromised FortiManager gadget to execute arbitrary code or instructions in opposition to different FortiManager units. 

This vulnerability, which carries a standard vulnerability severity rating (CVSS) of 9.8, is actively exploited within the wild, typically along with CVE-2024-23113, one other vulnerability in Fortinet merchandise found in February 2024.

🚨 Fortinet CVE-2024-23113 – actively exploited by state-sponsored hackers – is now being exploited by cybercriminals who’ve reverse-engineered it and are promoting entry to compromised units

If you have not patched, limit port 541 to accepted IPs or implement cert auth. pic.twitter.com/8ay8TnFq1b

— Matt Johansen (@mattjay) November 14, 2024

FortiJump has been analyzed by a number of safety suppliers, together with Google Cloud-owned Mandiant, Bishop Fox and Speedy 7.

Learn extra concerning the rise in vulnerability exploitation: Vulnerability Exploitation on the Rise as Attackers Ditch Phishing

Discovery of FortiJump Larger

In a brand new report revealed on November 15, watchTowr mentioned it got here throughout some new points in FortiManager whereas attempting to breed a FortiJump exploit in its lab.

Particularly, watchTowr claimed to have discovered a brand new vulnerability with an identical exploit approach that triggers FortiJump – FortiJump Larger – in addition to two file overwrite vulnerabilities that could possibly be leveraged to crash the system.

The corporate additionally claimed that the patch launched by Fortinet, supposed to repair FortiJump, isn’t efficient for all exploit strategies.

“[Our findings] indicate that Fortinet has merely patched the unsuitable code, within the unsuitable file, in a completely totally different library,” the watchTowr researchers mentioned within the report.

They claimed FortiJump Larger stays efficient even in patched variations, enabling adversaries to escalate privileges from a managed FortiGate equipment to the central FortiManager equipment. They added that compromising any managed FortiGate equipment will be leveraged to achieve management over the FortiManager itself – and, consequently, all different managed home equipment.

“Whereas we don’t have visibility into the internal workings of superior persistent risk (APT) teams, in our opinion, it appears extremely doubtless that profitable APT teams should not totally silly and maintain a excessive chance that in the event that they discovered one vulnerability on this magical answer of spaghetti – they doubtless noticed others, which Fortinet have left untouched,” they added. “The low complexity of those vulnerabilities brings into query the general high quality of the FortiManager codebase.”

watchTowr mentioned it contacted Fortinet about this new vulnerability. However, it determined to publish its findings earlier than any public response from the safety firm as a result of its researchers imagine that the similarities between FortiJump and FortiJump Larger imply that risk actors actively exploiting the previous are doubtless additionally exploiting the latter.

Infosecurity has contacted Fortinet. An organization spokesperson confirmed the brand new findings have “been despatched on to Fortinet’s HQ, who’re dealing with this request and shall be in contact as quickly as attainable.”

This can be a growing story and this text could also be up to date as new data turns into out there.