Advanced actor targets Fortinet FortiOS in attacks on govt entities

An unknown threat actor is targeting Government entities and large organizations by exploiting a security flaw in Fortinet FortiOS.

Fortinet researchers are warning of an advanced threat actor that is targeting governmental or government-related entities.

The unknown threat actor is exploiting a vulnerability in Fortinet FortiOS software, tracked as CVE-2022-41328, that may allow a privileged attacker to read and write arbitrary files via crafted CLI commands.

The CVE-2022-41328 vulnerability (CVSS score: 6.5) is a path traversal issue in FortiOS can can result in arbitrary code execution.

“A improper limitation of a pathname to a restricted directory vulnerability (‘path traversal’) [CWE-22] in FortiOS may allow a privileged attacker to read and write arbitrary files via crafted CLI commands.” reads the advisory published by Fortinet.

The vulnerability impacts FortiOS versions 6.0, 6.2, 6.4.0 through 6.4.11, 7.0.0 through 7.0.9, and 7.2.0 through 7.2.3. The company addressed the vulnerability with the release of versions 6.4.12, 7.0.10, and 7.2.4 respectively.

Fortinet launched an investigation into the attacks after the FortiGate devices of one customer suddenly halted and failed to reboot. The devices halted displaying the following error message:

“System enters error-mode due to FIPS error: Firmware Integrity self-test failed”

The failure of the integrity test blocks the re-boot of the device to protect the integrity of the network.

The researchers discovered that the attackers modified the /sbin/init folder in the firmware image, they noticed the presence of a new file /bin/fgfm. The modification aims at providing a persistent access to the attacker.

“The modification to /sbin/init ensures that /bin/fgfm, which may provide an attacker with persistent access and control, runs before proceeding with regular boot-up actions.” reads the analysis published by Fortinet.

Upon executing the fgfm malware, it contacts a remote server (C2) and awaits for commands to execute.

The malicious code can perform various actions depending on the commands it receives from the C&C server, including exit program, exfiltrate data, download/write files, establish a remote shell.

The security firm pointed out that the exploit requires a deep understanding of FortiOS and the underlying hardware, a circumstance that suggests the involvement of an advanced actor.

The attackers were able to create a custom implants based on the reverse-engineering of various parts of FortiOS.

“The attack is highly targeted, with some hints of preferred governmental or government-related targets.” concludes the company that also provided Indicators of Compromise.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Fortinet)