The most severe and maybe the most widely exploited Fortinet CVE, in our opinion, is CVE-2018-13379. Most often the objective has been financial gain through the extortion of victims who have had their critical data stolen and/or encrypted. There are numerous vulnerabilities exploited by attackers to breach network defences, laterally move within an environment, impersonate legitimate users, and ultimately, achieve their objective. For this reason, there must be a balance between the desire to achieve certainty in your root cause analysis, minimising security risks, and enabling an organisation to recover as quickly as possible. Timing is critical when you are responding to security incidents, as they can substantially impact business operations. This drove us to delve a little deeper into these vulnerabilities and determine whether there was any evidence that could be extracted from the devices to support the hypothesis.Ĭonfirming or disproving assumptions regarding the root cause of an incident is important, as it allows you to make informed decisions during the response process and more effectively prioritise security requirements. We believe this vulnerability was most likely used by attackers to gain initial access in all recent cases investigated by ParaFlare, where an unpatched Fortinet device was involved.ĭuring these response engagements, while ParaFlare were able to assess the likelihood of the attacker utilising the exploits as disclosed by this blog post, the evidence has not been available to support these assumptions. Therefore, enabling the threat actor to access the SSL VPN with legitimate user credentials. The vulnerability assigned the reference CVE-2018-13379 allows an unauthenticated, remote actor to read sensitive files on the Fortinet device, including the usernames and plaintext passwords contained in the “sslvpn_websession” file. It is our assumption that the exploitation of CVE-2018-13379, an ‘Improper Limitation of a Pathname to a Restricted Directory (Path Traversal), was to blame.

Over the past 12 months, ParaFlare’s Incident Response team has assisted with the response, containment and remediation of several large-scale ransomware cases that involved unpatched Fortinet FortiGate firewalls.Īs such, we have analysed several CVEs that have impacted Fortinet devices worldwide and have led to devastating attacks on networks from the perimeter device inwards. The exploitation of Fortinet FortiOS vulnerabilities has been very topical of late.

Fortinet vpn client log