The FBI and the Cybersecurity and Infrastructure Security Agency said that advanced hackers are likely exploiting critical vulnerabilities in the Fortinet FortiOS VPN in an attempt to plant a beachhead to breach medium and large-sized businesses in later attacks.
“APT actors may use these vulnerabilities or other common exploitation techniques to gain initial access to multiple government, commercial, and technology services,” the agencies said Friday in a joint advisory. “Gaining initial access pre-positions the APT actors to conduct future attacks.” APT is short for advanced persistent threat, a term used to describe well-organized and well-funded hacking groups, many backed by nation states.
Breaching the mote
Fortinet FortiOS SSL VPNs are used mainly in border firewalls, which cordon off sensitive internal networks from the public Internet. Two of the three already-patched vulnerabilities listed in the advisory—CVE-2018-13379 and CVE-2020-12812—are particularly severe because they make it possible for unauthenticated hackers to steal credentials and connect to VPNs that have yet to be updated.
“If the VPN credentials are also shared with other internal services (e.g. if they’re Active Directory, LDAP, or similar single sign-on credentials) then the attacker immediately gains access to those services with the privileges of the user whose credentials were stolen,” said James Renken, a site reliability engineer at the Internet Security Research Group. Renken is one of two people credited with discovering a third FortiOS vulnerability—CVE-2019-5591—that Friday’s advisory said was also likely being exploited. “The attacker can then explore the network, pivot to trying to exploit various internal services, etc.”
One of the most severe security bugs — CVE-2018-13379—was found and disclosed by researchers Orange Tsai and Meh Chang of security firm Devcore. Slides from a talk the researchers gave at the Black Hat Security Conference in 2019 describe it as providing “pre-auth arbitrary file reading,” meaning it allows the exploiter to read password databases or other files of interest.
Security firm Tenable, meanwhile, said that CVE-2020-12812 can result in an exploiter bypassing two-factor authentication and logging in successfully.
In an emailed statement, Fortinet said:
The security of our customers is our first priority. CVE-2018-13379 is an old vulnerability resolved in May 2019. Fortinet immediately issued a PSIRT advisory and communicated directly with customers and via corporate blog posts on multiple occasions in August 2019 and July 2020 strongly recommending an upgrade. Upon resolution we have consistently communicated with customers as recently as late as 2020. CVE-2019-5591 was resolved in July 2019 and CVE-2020-12812 was resolved in July 2020. To get more information, please visit our blog and immediately refer to the May 2019 advisory. If customers have not done so, we urge them to immediately implement the upgrade and mitigations.
The FBI and CISA provided no details about the APT mentioned in the joint advisory. The advisory also hedges by saying that there is a “likelihood” the threat actors are actively exploiting the vulnerabilities.
Patching the vulnerabilities requires IT administrators to make configuration changes, and unless an organization is using a network with more than one VPN device, there will be downtime. While those barriers are often tough in environments that need VPNs to be available around the clock, the risk of being swept into a ransomware or espionage compromise is significantly greater.
