CVE-2024-21762: Critical Fortinet FortiOS Vulnerability
Background
CVE-2024-21762
CVE-2024-23113
Public Exploitation
Fortinet stated that this vulnerability is “potentially being exploited in the wild” in its report dated February 8. It has not disclosed any information regarding exploitation in the wild or about the identity of the person who first reported the bug on February 9.
State-sponsored and other highly motivated threat actors have a history of targeting zero-day vulnerabilities in Fortinet SSL VPNs. Following public publication, adversaries have taken use of further recent Fortinet SSL VPN vulnerabilities (such as CVE-2022-42475, CVE-2022-41328, and CVE-2023-27997) as both zero-day and n-day exploits.
Fortinet revealed yesterday that Volt Typhoon, a state-sponsored threat actor from China, was using FortiOS vulnerabilities to spread custom malware known as COATHANGER.
Recently, it was discovered that this malware, a specially created remote access trojan (RAT) intended to compromise Fortigate network security equipment, was being utilized in attacks on the Dutch Ministry of Defense.
Affected Versions
| Product | Vulnerability | Affected Version | Fixed Version |
|---|---|---|---|
| FortiOS | CVE-2024-23113, CVE-2024-21762 | 7.4.0 through 7.4.2 | 7.4.3 or above |
| CVE-2024-23113, CVE-2024-21762 | 7.2.0 through 7.2.6 | 7.2.7 or above | |
| CVE-2024-23113, CVE-2024-21762 | 7.0.0 through 7.0.13 | 7.0.14 or above | |
| CVE-2024-21762 | 6.4.0 through 6.4.14 | 6.4.15 or above | |
| CVE-2024-21762 | 6.2.0 through 6.2.15 | 6.2.16 or above | |
| CVE-2024-21762 | 6.0 all versions | Migrate to a fixed release | |
| FortiSIEM | CVE-2024-23108, CVE-2024-23109 | 7.1.0 through 7.1.1 7.0.0 through 7.0.2 6.7.0 through 6.7.8 6.6.0 through 6.6.3 6.5.0 through 6.5.2 6.4.0 through 6.4.2 | 7.1.2 or above 7.0.3 or above 6.7.9 or above 7.2.0 or above 6.6.5 or above 6.5.3 or above 6.4.4 or above |
Recommendations
We strongly recommend upgrading to the latest patched versions of FortiOS and FortiSIEM to address these vulnerabilities.
FortiGuard has also supplied the following workarounds for users who are presently unable to apply patches:
Remove fgfm Access:
Until the system can be patched, fgfm access on each interface can be removed as a temporary solution for CVE-2024-23113. Consult the FortiGuard advisory for CVE-2024-23113 to learn about the particular modifications.
Turn Off SSL VPN:
Disabling SSL VPN on FortiOS devices can reduce the risk associated with CVE-2024-21762, at least until the device can be updated to a fixed version.
References
https://www.fortiguard.com/psirt/FG-IR-24-015
https://www.fortiguard.com/psirt/FG-IR-24-029