CVE-2022-28672

CVE-2022-28672 Foxit PDF Reader Vulnerability - UaF - RCE - JIT Spraying FortiOS, FortiProxy and FortiSwitchManager Authentication Bypass IOC (CVE-2022-40684)

Introduction The recent FortiOS / FortiProxy / FortiSwitchManager CVE has been exploited in the wild. We would like to provide additional information about the vulnerability so that users can begin to determine if they have been compromised. In this post we discuss enabling logging and IOCs for FortiOS 7.2.1. These steps are likely to work on other vulnerable products, however, we do not have other products configured in our lab for testing. See the details of our technical dive here.

Logging If not already configured, REST API logging can be set via the Fortinet CLI with the following commands:

fortios_7_2_1 # config log setting
fortios_7_2_1 (setting) # set rest-api-set enable
fortios_7_2_1 (setting) # set rest-api-get enable
fortios_7_2_1 (setting) # end
fortios_7_2_1 # 

IOCs

In addition to Fortinet's recommendations to check device logs for user="Local_Process_Access", any affected system should also be reviewed for logs with user_interface="Node.js" or user_interface="Report Runner". See the screenshots below for examples of the exploit running on our lab systems.

node js log Node JS log

report runner log Report runner log

The exploit can be used with any HTTP method (GET, POST, PUT, DELETE, etc.). Additionally, an error in the REST API request is not an indication that an attacker was not successful. In our lab environment, we were able to modify administrator users' SSH keys via a REST API request that reportedly failed. We would also like to point out that a system configured for production use may produce logs that match these IOCs naturally. However, we would not expect these IOCs to match URLs targeting sensitive REST API endpoints.

#Attacker mindset The /api/v2/ collection endpoints can be used to configure the system and modify the administrator user. Any log found that meets the above conditions and also has a URL containing /api/v2/ should be a cause for concern. Further investigation of any matching log entries may reveal any damage caused by an attack. Additionally, an attacker can perform the following actions to further compromise a system:

Modify administrator users' SSH keys to allow the attacker to log into the compromised system. Add new local users. Update network configurations to redirect traffic. Download the system configuration. Start packet captures to capture traffic.

Mitigación

It is recommended to implement mitigation measures immediately to protect against future attacks. These include:

Asegúrese de que todos los sistemas estén actualizados con la última versión de FortiOS. Configure una contraseña segura para el usuario administrador. Configure la autenticación de dos factores para el usuario administrador. Configure la contraseña de cifrado para proteger las contraseñas almacenadas. Limite el acceso a los extremos de la API REST a solo las direcciones IP confiables. Habilite el registro de la API REST para monitorear el uso de la API.

Conclusion This CVE is a reminder of the importance of keeping systems up to date and protecting REST API endpoints with appropriate security measures. FortiOS, FortiProxy and FortiSwitchManager users should take immediate action to protect themselves from future attacks and perform a thorough review of their systems to determine if they have been compromised.