FortiManager Zero-Day Vulnerability (CVE-2024-47575)

THE THREAT

On October 23rd, Fortinet disclosed an actively exploited critical zero-day vulnerability impacting multiple versions for FortiManager. The vulnerability, tracked as CVE-2024-47575 (CVSS: 9.8), is due to missing authentication for a function in the FortiManager fgfmd daemon. Exploitation would allow a remote and unauthenticated threat actor to execute arbitrary code or commands via specially crafted requests. At this time, real-world attacks are reported to have resulted in the theft of sensitive files which contain IPs, credentials, and configuration details.

As exploitation has been confirmed, it is critical that organizations using FortiManager apply the relevant security patches or alternative mitigations immediately.

What we’re doing about it

• Known malicious IP addresses are blocked via the eSentire Global Block List
• eSentire’s Threat Response Unit (TRU) has performed threat hunts across the client base for known Indicators of Compromise
• eSentire Managed Vulnerability Service (MVS) has plugins in place to identify vulnerable devices
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches
• If patching is not immediately possible, Fortinet has provided three temporary mitigations in their vulnerability disclosure
  • See the full Fortinet advisory for alternative mitigation recommendations

Additional information

eSentire was alerted to this vulnerability via a private information sharing partner on October 18th, allowing for proactive threat hunts and blocking of malicious infrastructure prior to public disclosure of CVE-2024-47575. Details on real-world exploitation are currently minimal. The eSentire Threat Response Unit (TRU) will continue tracking this vulnerability for additional details and detection opportunities.

References:

[1] https://www.fortiguard.com/psirt/FG-IR-24-423
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-47575
[3] https://www.fortiguard.com/psirt/FG-IR-24-423#:~:text=Workarounds,the%20above%20workarounds.