Fortinet Warns of FortiManager Critical Remote Code Execution Vulnerability: CVE-2024-47575
A new critical vulnerability, CVE-2024-47575, has been discovered in Fortinet's FortiManager and FortiManager Cloud products, potentially allowing remote code execution (RCE). The vulnerability is actively being exploited in the wild, with reports emerging from users and security researchers alike. Despite the severity, Fortinet has been slow to publicly acknowledge the issue, though some customers have been privately notified via email.
What is the vulnerability?
This vulnerability allows an unauthenticated attacker to gain remote control of FortiManager by sending specially crafted requests. The flaw stems from FortiManager’s FGFM protocol (FortiGate to FortiManager), where unauthorized devices with unknown serial numbers can register themselves with the FortiManager system. Once a malicious device is registered, the attacker can execute arbitrary code on the FortiManager system, potentially compromising entire networks managed by it, especially in environments run by Managed Service Providers (MSPs).
Affected Versions
The following FortiManager versions are vulnerable:
- FortiManager 7.6.0
- FortiManager 7.4.4
- FortiManager 7.2.7
- FortiManager 7.0.12
- FortiManager 6.4.14 and older
Fortinet has issued patches for some versions, but not all. Affected users are encouraged to check for updates and apply them as soon as possible.
How to determine if you're vulnerable
Users can take the following steps to determine if their FortiManager system is potentially vulnerable:
- Check your version: Review your FortiManager version. If it matches any of the affected versions listed above, your system could be at risk.
- Audit FGFM traffic: Inspect any abnormal traffic on FGFM’s default ports—port 541 for IPv4 and port 542 for IPv6. This protocol is primarily used for managing FortiGate firewalls through FortiManager.
- Scan for suspicious IPs: Cross-check your logs for any IP addresses attempting to exploit FGFM. Some known malicious IPs have been detected and reported by security researchers. Fortinet's advisory may contain additional details.
- Check for unauthorized devices: Look for unknown or unexpected devices that may have registered with FortiManager.
Mitigations and Updates
Fortinet has recommended users immediately apply the latest patches where available. For those running versions without patches, consider the following mitigations:
Disable FGFM on internet-facing devices: Disable the FGFM protocol on devices exposed to the public internet. This can be done via FortiManager’s configuration settings, though users of versions 7.6.0 and 6.4.14 have reported that this method may not work.
Apply patches: Fortinet has now released patches for some versions. If your version has an available patch, update your system to the latest version. Users running versions without patches should closely monitor Fortinet’s security bulletins.
Monitor network activity: Continuously monitor network traffic for signs of exploitation. Specifically, watch for traffic on FGFM-related ports (541 and 542) and block any suspicious activity.
Conclusion
CVE-2024-47575 represents a critical threat to FortiManager users, particularly those in managed service environments. While Fortinet has begun releasing patches, many versions remain without a fix. Users should take immediate steps to mitigate risk by disabling FGFM on vulnerable versions, monitoring network activity, and applying patches as soon as they become available.
By staying vigilant and applying the necessary mitigations, organizations can protect themselves from potential attacks leveraging this serious vulnerability.
Read our annotated CVE report at this link: https://basefortify.eu/cve_reports/2024/10/cve-2024-47575.html
Other sources:
Fortinet waarschuwt voor actief misbruikte kwetsbaarheid in FortiManager - Security.NL
