CVE-2024-47575

Published Oct 23, 2024

Last updated a year ago

Exploit known CVSS critical 9.8

FortiJump

Network

Zero-day

API

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-47575, also referred to as "FortiJump," is a missing authentication vulnerability affecting the FortiGate to FortiManager (FGFM) service daemon (`fgfmd` or `fgfmsd`) in Fortinet's FortiManager and FortiManager Cloud devices. The vulnerability allows a remote, unauthenticated attacker to execute arbitrary code or commands by sending specially crafted requests to the FGFM protocol listening on TCP port 541. In-the-wild exploitation of this vulnerability was observed as a zero-day starting as early as June 2024, prior to Fortinet's public advisory and patch releases in October 2024. Threat actors have leveraged the flaw to register unauthorized, rogue devices to targeted FortiManager consoles. Once connected, attackers have automated the exfiltration of sensitive configuration files, IP addresses, and cryptographic credentials belonging to the managed FortiGate firewalls.

Description: A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.
Source: psirt@fortinet.com
NVD status: Analyzed
Products: fortimanager, fortimanager_cloud

Insights

Analysis from the Intruder Security Team

Published Oct 24, 2024

For an instance of FortiManager to be exploitable by this vulnerability (FortiJump), the FGFM protocol (tcp/541 or tcp/542 if using IPv6) needs to be exposed to the internet, either by the FortiManager instance or a FortiGate device which is connected to a vulnerable FortiManager instance. This is because the FGFM protocol can allow access to FortiManager devices which are behind NAT if a FortiGate product is exposed to the internet and has FGFM enabled.

FGFM needs to be enabled, this is now disabled by default following the patch for CVE-2024-23113.

Mandiant have a comprehensive article on this weakness, its use in the wild by threat actors, IOCs and mitigation strategies. Watchtowr have released a second blog explaining the full technical details of this attack. In this post Watchtowr outline how the original mitigations did not fully patch systems against this vulnerability.

Intruder customers can use the attack surface view to find out if they have port tcp/541 exposed to the internet.

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Fortinet FortiManager Missing Authentication Vulnerability
Exploit added on: Oct 23, 2024
Exploit action due: Nov 13, 2024
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

psirt@fortinet.com: CWE-306

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D7E60883-7F64-4C22-99F9-802A7623DAE0",
            "versionEndExcluding": "6.2.13",
            "versionStartIncluding": "6.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D2AD66B0-9C99-4F83-80AA-B54E6354ADFD",
            "versionEndExcluding": "6.4.15",
            "versionStartIncluding": "6.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "37456E27-0EE2-4AF8-B92F-A5284FEC0409",
            "versionEndExcluding": "7.0.13",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "01E63E1E-4084-4C73-862F-A4CC07914C23",
            "versionEndExcluding": "7.2.8",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0666260A-1327-4C43-A841-04FB4459449C",
            "versionEndExcluding": "7.4.5",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "0141F06A-F5FE-4DF3-B60E-DD76A1AD8A56",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5BB52FA5-7811-4123-8989-59369583F82F",
            "versionEndIncluding": "6.4.7",
            "versionStartIncluding": "6.4.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "29B3A5F2-3121-4902-BBB6-8B4D07767F77",
            "versionEndExcluding": "7.0.13",
            "versionStartIncluding": "7.0.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E3A26BF0-DF69-42F6-B9D8-D3BEE3DD352C",
            "versionEndExcluding": "7.2.8",
            "versionStartIncluding": "7.2.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6E0BCF26-B311-4FFF-866B-3DCA14A26268",
            "versionEndExcluding": "7.4.5",
            "versionStartIncluding": "7.4.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.