The FBI and the Cybersecurity and Infrastructure Security Agency said that advanced hackers are likely exploiting critical vulnerabilities in the Fortinet FortiOS VPN in an attempt to plant a beachhead to breach medium and large-sized businesses in later attacks.
“APT actors may use these vulnerabilities or other common exploitation techniques to gain initial access to multiple government, commercial, and technology services,” the agencies said Friday in a joint advisory. “Gaining initial access pre-positions the APT actors to conduct future attacks.” APT is short for advanced persistent threat, a term used to describe well-organized and well-funded hacking groups, many backed by nation states.
Breaching the mote
Fortinet FortiOS SSL VPNs are used mainly in border firewalls, which cordon off sensitive internal networks from the public Internet. Two of the three already-patched vulnerabilities listed in the advisory—CVE-2018-13379 and CVE-2020-12812—are particularly severe because they make it possible for unauthenticated hackers to steal credentials and connect to VPNs that have yet to be updated.
“If the VPN credentials are also shared with other internal services (e.g. if they’re Active Directory, LDAP, or similar single sign-on credentials) then the attacker immediately gains access to those services with the privileges of the user whose credentials were stolen,” said James Renken, a site reliability engineer at the Internet Security Research Group. Renken is one of two people credited with discovering a third FortiOS vulnerability—CVE-2019-5591—that Friday’s advisory said was also likely being exploited. “The attacker can then explore the network, pivot to trying to exploit various internal services, etc.”
One of the most severe security bugs — CVE-2018-13379—was found and disclosed by researchers Orange Tsai and Meh Chang of security firm Devcore. Slides from a talk the researchers gave at the Black Hat Security Conference in 2019 describe it as providing “pre-auth arbitrary file reading,” meaning it allows the exploiter to read password databases or other files of interest.
Security firm Tenable, meanwhile, said that CVE-2020-12812 can result in an exploiter bypassing two-factor authentication and logging in successfully.
The FBI and CISA provided no details about the APT mentioned in the joint advisory. The advisory also hedges by saying that there is a “likelihood” the threat actors are actively exploiting the vulnerabilities.
Patching the vulnerabilities requires IT administrators to make configuration changes, and unless an organization is using a network with more than one VPN device, there will be downtime. While those barriers are often tough in environments that need VPNs to be available around the clock, the risk of being swept into a ransomware or espionage compromise is significantly greater.