CVE-2024-47575 Vulnerability in FortiManager

Published: 24 October 2024

Prepared by: Jack Rutherford, Chief Technology Officer

Purpose 

The purpose of this bulletin is to address a recent report by the Australian Cyber Security Centre (ACSC) and Mandiant (Google) surrounding the active exploitation of a CRITICAL-risk vulnerability present in Fortinet FortiManager.  

As this vulnerability allows potential attackers to perform unauthenticated Remote Code Execution (RCE), and due to the fact that Mandiant have uncovered a campaign of mass exploitation of this vulnerability, the Triskele Labs team strongly advises that all organisations using affected versions of FortiManager should follow the remediation steps outlined in the subsequent sections. This vulnerability is being tracked as CVE-2024-47575. 

Furthermore, Triskele Labs strongly advises that where possible, Fortinet FortiManager is not exposed to the Internet, to prevent threats of this nature in future.  

CVE-2024-23113 Details 

On 23 October 2024, FortiGuard Labs published vulnerability disclosure (FG-IR-24-423) reserved as CVE-2024-47575, impacting the following versions of FortiOS. 

Impact  

The attack paths for this vulnerability could be used for initial access to a network, data exfiltration, data encryption, or network traversal. Due to the criticality of this vulnerability and its potential exploitation, devices using affected versions of FortiManager should be treated as an optimal target for a threat actor and patched as a priority for the business, to prevent exfiltration of data and leakage of Personally Identifiable Information (PII), and other sensitive data. 

This vulnerability has been assigned a Common Vulnerability Scoring System (CVSS) score of 9.8/10.  

Mitigation Actions 

Triskele Labs recommends upgrading to the latest version of FortiManger immediately, in-line with the advice from FortiGuard Labs. The upgrade paths in the table below, provided by FortiGuard Labs, can be used to mitigate this vulnerability:  

• https://www.fortiguard.com/psirt/FG-IR-24-423 

If you are utilising an instance of FortiManager listed as impacted by this vulnerability, Triskele Labs recommends reviewing the firewall logs for unusual activity, in case this vulnerability has already been exploited. If this is the case, persistence may already be present, which an update will not remediate.  

Triskele Labs recommends that where possible, administrative interfaces such as FortiManager are never exposed to the Internet, to prevent the exploitation of vulnerabilities of this nature.  

Detection Capabilities 

Triskele Labs SOC customers with our Vulnerability Scanning service are being assessed currently. All customers with our Monitor service (24x7x365 Managed Detection and Response) are - as always - being monitored for IOCs and Lateral Movement. 

References  

• https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/vulnerability-in-fortinets-fortimanager 
• https://cloud.google.com/blog/topics/threat-intelligence/fortimanager-zero-day-exploitation-cve-2024-47575 
• https://www.fortiguard.com/psirt/FG-IR-24-423