Critical Authentication Bypass Vulnerability Affecting FortiOS, FortiProxy and FortiSwitchManager
A critical vulnerability affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager has been identified. It enables an unauthenticated remote attacker to perform administrative actions on exposed management interfaces via crafted HTTP or HTTPS requests.
Description
Technical context and vulnerability details
FortiOS, FortiProxy, and FortiSwitchManager share central management interface modules for policy definition, switch provisioning, and gateway filtering.
These products are affected by the following vulnerabilities:
CVE-2022-40684: Critical authentication bypass using an alternate path or channel (CWE-288) in the administrative web service. A remote attacker can craft HTTP headers to impersonate local administrative channels. Classified Critical with a CVSS v3.1 base score of 9.8.
Potential Risks & Impact
Potential consequences upon exploitation
- Complete authentication bypass on exposed management interfaces;
- Arbitrary configuration modifications and unauthorized firmware actions;
- Complete compromise of device integrity and firewall perimeter control.
Affected systems
Products, components and targeted versions
- FortiOS 7.2: versions 7.2.0 to 7.2.1;
- FortiOS 7.0: versions 7.0.0 to 7.0.6;
- FortiProxy 7.2: version 7.2.0;
- FortiProxy 7.0: versions 7.0.0 to 7.0.6;
- FortiSwitchManager 7.2: version 7.2.0;
- FortiSwitchManager 7.0: version 7.0.0.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Upgrade FortiOS to versions 7.2.2 or 7.0.7 or higher;
- Upgrade FortiProxy to versions 7.2.1 or 7.0.7 or higher;
- Upgrade FortiSwitchManager to version 7.2.1 or higher;
- Disable internet-facing administrative access (HTTPS/HTTP) or implement local access control lists immediately.
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.