"comment":"IDS not flag not set (as many FPs are possible) but for forensic evaluation it could be useful (as mentioned in Fortinet report as \"Presence of the following artifacts in the filesystem:\").",
"deleted":false,
"disable_correlation":false,
"timestamp":"1670918523",
"to_ids":false,
"type":"filename-pattern",
"uuid":"67c635c3-156e-4374-8539-03dc022ead94",
"value":"/data/lib/libips.bak"
},
{
"category":"Artifacts dropped",
"comment":"IDS not flag not set (as many FPs are possible) but for forensic evaluation it could be useful (as mentioned in Fortinet report as \"Presence of the following artifacts in the filesystem:\").",
"deleted":false,
"disable_correlation":false,
"timestamp":"1670918523",
"to_ids":false,
"type":"filename-pattern",
"uuid":"056cf46f-19ac-4d56-b479-2910c6338304",
"value":"/data/lib/libgif.so"
},
{
"category":"Artifacts dropped",
"comment":"IDS not flag not set (as many FPs are possible) but for forensic evaluation it could be useful (as mentioned in Fortinet report as \"Presence of the following artifacts in the filesystem:\").",
"deleted":false,
"disable_correlation":false,
"timestamp":"1670918523",
"to_ids":false,
"type":"filename-pattern",
"uuid":"418c4e99-bc14-4758-acb7-79839693c7a5",
"value":"/data/lib/libiptcp.so"
},
{
"category":"Artifacts dropped",
"comment":"IDS not flag not set (as many FPs are possible) but for forensic evaluation it could be useful (as mentioned in Fortinet report as \"Presence of the following artifacts in the filesystem:\").",
"deleted":false,
"disable_correlation":false,
"timestamp":"1670918523",
"to_ids":false,
"type":"filename-pattern",
"uuid":"d369428b-c79c-4e53-ac8b-e66b7e37bf35",
"value":"/data/lib/libipudp.so"
},
{
"category":"Artifacts dropped",
"comment":"IDS not flag not set (as many FPs are possible) but for forensic evaluation it could be useful (as mentioned in Fortinet report as \"Presence of the following artifacts in the filesystem:\").",
"deleted":false,
"disable_correlation":false,
"timestamp":"1670918523",
"to_ids":false,
"type":"filename-pattern",
"uuid":"27d86af6-151c-4222-90f4-4e78da4ea247",
"value":"/data/lib/libjepg.so"
},
{
"category":"Artifacts dropped",
"comment":"IDS not flag not set (as many FPs are possible) but for forensic evaluation it could be useful (as mentioned in Fortinet report as \"Presence of the following artifacts in the filesystem:\").",
"deleted":false,
"disable_correlation":false,
"timestamp":"1670918523",
"to_ids":false,
"type":"filename-pattern",
"uuid":"34941db8-634e-41c6-8547-3f21dc259b8f",
"value":"/var/.sslvpnconfigbk"
},
{
"category":"Artifacts dropped",
"comment":"IDS not flag not set (as many FPs are possible) but for forensic evaluation it could be useful (as mentioned in Fortinet report as \"Presence of the following artifacts in the filesystem:\").",
"deleted":false,
"disable_correlation":false,
"timestamp":"1670918523",
"to_ids":false,
"type":"filename-pattern",
"uuid":"25ec1150-a6b5-4ddd-8fd4-0667afc4791a",
"value":"/data/etc/wxd.conf"
},
{
"category":"Artifacts dropped",
"comment":"IDS not flag not set (as many FPs are possible) but for forensic evaluation it could be useful (as mentioned in Fortinet report as \"Presence of the following artifacts in the filesystem:\").",
"deleted":false,
"disable_correlation":false,
"timestamp":"1670918523",
"to_ids":false,
"type":"filename-pattern",
"uuid":"631df53c-1aa6-49cb-8147-2938c98de666",
"value":"/flash"
},
{
"category":"Network activity",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1671440259",
"to_ids":true,
"type":"ip-dst",
"uuid":"c11e8f34-bd5c-455c-97c6-f8e1963cdc9f",
"value":"139.180.184.197"
},
{
"category":"Network activity",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1671440259",
"to_ids":true,
"type":"ip-dst",
"uuid":"75c27d03-3cda-44ac-93e3-eefa8fb17262",
"value":"66.42.91.32"
},
{
"category":"Network activity",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1671440259",
"to_ids":true,
"type":"ip-dst",
"uuid":"2694f1c0-6740-4581-a259-8258400713ac",
"value":"158.247.221.101"
},
{
"category":"Network activity",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1671440259",
"to_ids":true,
"type":"ip-dst",
"uuid":"857a5707-7a4f-4dbe-85ed-ba23bdaf5883",
"value":"107.148.27.117"
},
{
"category":"Network activity",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1671440259",
"to_ids":true,
"type":"ip-dst",
"uuid":"28031de1-697f-4cab-9667-a424c98a8ed0",
"value":"139.180.128.142"
},
{
"category":"Network activity",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1671440259",
"to_ids":true,
"type":"ip-dst",
"uuid":"01257f8a-da5d-42a1-a530-daf87ab7b111",
"value":"155.138.224.122"
},
{
"category":"Network activity",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1671440259",
"to_ids":true,
"type":"ip-dst",
"uuid":"e04f171a-85a5-4e27-a59a-e84fb0c74b0c",
"value":"185.174.136.20"
}
],
"Object":[
{
"comment":"",
"deleted":false,
"description":"Metadata used to generate an executive level report",
"value":"Fortinet urges customers to patch their appliances against an actively exploited FortiOS\u00a0SSL-VPN vulnerability that could allow unauthenticated remote code execution on devices.\r\n\r\nThe security flaw is tracked as CVE-2022-42475 and is a heap-based buffer overflow bug in FortiOS sslvpnd. When exploited, the flaw could allow unauthenticated users to crash devices remotely and potentially perform code execution."
},
{
"category":"Other",
"comment":"",
"deleted":false,
"disable_correlation":true,
"object_relation":"type",
"timestamp":"1670917344",
"to_ids":false,
"type":"text",
"uuid":"be393bf3-786c-429a-8f25-24d089647e04",
"value":"Webpage"
}
]
},
{
"comment":"",
"deleted":false,
"description":"An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
"value":"A heap-based buffer overflow vulnerability [CWE-122]\u00a0in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests."
},
{
"category":"Other",
"comment":"",
"deleted":false,
"disable_correlation":true,
"object_relation":"type",
"timestamp":"1670917641",
"to_ids":false,
"type":"text",
"uuid":"1ef68fcd-2b25-447f-8e71-48a6d80acaaf",
"value":"Report"
}
]
},
{
"comment":"",
"deleted":false,
"description":"Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.",
"value":"FortiOS version 7.2.0 through 7.2.2\r\nFortiOS version 7.0.0 through 7.0.8\r\nFortiOS version 6.4.0 through 6.4.10\r\nFortiOS version 6.2.0 through 6.2.11\r\nFortiOS-6K7K version 7.0.0 through 7.0.7\r\nFortiOS-6K7K version 6.4.0 through 6.4.9\r\nFortiOS-6K7K version 6.2.0 through 6.2.11\r\nFortiOS-6K7K version 6.0.0 through 6.0.14\r\nare vulnerable"
"name":"Bleepingcomputer: Fortinet says SSL-VPN pre-auth RCE bug is exploited in attacks",
"content":"# Bleepingcomputer: Fortinet says SSL-VPN pre-auth RCE bug is exploited in attacks\r\nFrom: `https://www.bleepingcomputer.com/news/security/fortinet-says-ssl-vpn-pre-auth-rce-bug-is-exploited-in-attacks/`\r\n\r\nFortinet urges customers to patch their appliances against an actively exploited FortiOS SSL-VPN vulnerability that could allow unauthenticated remote code execution on devices.\r\n\r\nThe security flaw is tracked as CVE-2022-42475 and is a heap-based buffer overflow bug in FortiOS sslvpnd. When exploited, the flaw could allow unauthenticated users to crash devices remotely and potentially perform code execution.\r\n\r\n\"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests,\" warns Fortinet in a security advisory released today.\r\n\r\nAs reported by LeMagIT, French cybersecurity firm Olympe Cyberdefense first disclosed the Fortinet zero-day vulnerability, warning users to monitor their logs for suspicious activity until a patch was released.\r\n\r\nFortinet quietly fixed the bug on November 28th in FortiOS 7.2.3 (other versions released earlier) without releasing any information about it being exploited as a zero-day.\r\n\r\nHowever, BleepingComputer has learned that the company issued a private TLP:Amber advisory to customers on December 7th with more information about the bug.\r\n\r\nToday, Fortinet released security advisory FG-IR-22-398, publicly warning that the vulnerability has been actively exploited in attacks and that all users should update to the following versions to fix the bug.\r\n\r\n```\r\nFortiOS version 7.2.3 or above\r\nFortiOS version 7.0.9 or above\r\nFortiOS version 6.4.11 or above\r\nFortiOS version 6.2.12 or above\r\nFortiOS-6K7K version 7.0.8 or above\r\nFortiOS-6K7K version 6.4.10 or above\r\nFortiOS-6K7K version 6.2.12 or above\r\nFortiOS-6K7K version 6.0.15 or above\r\n```\r\n\r\n## Actively exploited in attacks\r\n\r\nWhile Fortinet has not provided any information on how the flaw is being exploited, they shared IOCs related to attacks.\r\n\r\nAs shared previously by Olympe Cyberdefense and now Fortinet, when the vulnerability is exploited, it will generate the following entries in the logs:\r\n```\r\nLogdesc=\"Application crashed\" and msg=\"[...] application:sslvpnd,[...], Signal 11 received, Backtrace: [...]\u201c\r\n```\r\n\r\nFortinet warned that the following file system artifacts would be present on exploited devices:\r\n```\r\n/data/lib/libips.bak\r\n/data/lib/libgif.so\r\n/data/lib/libiptcp.so\r\n/data/lib/libipudp.so\r\n/data/lib/libjepg.so\r\n/var/.sslvpnconfigbk\r\n/data/etc/wxd.conf\r\n/flash\r\n```\r\n\r\nFortinet also shared a list of IP addresses seen exploiting the vulnerability, listed below.\r\n```\r\n188.34.130.40:444\r\n103.131.189.143:30080,30081,30443,20443\r\n192.36.119.61:8443,444\r\n172.247.168.153:8033\r\n```\r\nOf these IP addresses, threat intelligence company Grey Noise has detected the 103.131.189.143 address previously performing network scans in October.\r\n\r\nIf you are unable to apply the patches immediately, Olympe Cyberdefense suggests customers monitor logs, disable the VPN-SSL functionality, and create access rules to limit connections from specific IP addresses.\r\n\r\n*Update 12/12/22: Added information about private advisory. Fixed CVE.*",
"id":"138",
"event_id":"109029",
"timestamp":"1670919581",
"uuid":"8cdc2138-82ae-4177-bb67-7a9cd177440d",
"deleted":false
},
{
"name":"PSIRT Advisories: FortiOS - heap-based buffer overflow in sslvpnd",
"content":"# PSIRT Advisories\r\n\r\n## FortiOS - heap-based buffer overflow in sslvpnd\r\nFrom: `https://www.fortiguard.com/psirt/FG-IR-22-398`\r\n\r\n### Summary\r\n\r\nA heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.\r\n\r\n#### Exploitation status\r\nFortinet is aware of an instance where this vulnerability was exploited in the wild, and recommends immediately validating your systems against the following indicators of compromise:\r\n\r\n**Multiple log entries with:**\r\n```\r\nLogdesc=\"Application crashed\" and msg=\"[...] application:sslvpnd,[...], Signal 11 received, Backtrace: [...]\u201c\r\n```\r\n \r\n**Presence of the following artifacts in the filesystem:**\r\n```\r\n /data/lib/libips.bak \r\n /data/lib/libgif.so \r\n /data/lib/libiptcp.so \r\n /data/lib/libipudp.so \r\n /data/lib/libjepg.so \r\n /var/.sslvpnconfigbk \r\n /data/etc/wxd.conf \r\n /flash\r\n```\r\n \r\n**Connections to suspicious IP addresses from the FortiGate:**\r\n```\r\n 188.34.130.40:444 \r\n 103.131.189.143:30080,30081,30443,20443 \r\n 192.36.119.61:8443,444 \r\n 172.247.168.153:8033\r\n```\r\n \r\n### Affected Products\r\n\r\n- FortiOS version 7.2.0 through 7.2.2\r\n- FortiOS version 7.0.0 through 7.0.8\r\n- FortiOS version 6.4.0 through 6.4.10\r\n- FortiOS version 6.2.0 through 6.2.11\r\n- FortiOS-6K7K version 7.0.0 through 7.0.7\r\n- FortiOS-6K7K version 6.4.0 through 6.4.9\r\n- FortiOS-6K7K version 6.2.0 through 6.2.11\r\n- FortiOS-6K7K version 6.0.0 through 6.0.14\r\n\r\n### Solutions\r\n\r\n- Please upgrade to FortiOS version 7.2.3 or above\r\n- Please upgrade to FortiOS version 7.0.9 or above\r\n- Please upgrade to FortiOS version 6.4.11 or above\r\n- Please upgrade to FortiOS version 6.2.12 or above\r\n- Please upgrade to FortiOS-6K7K version 7.0.8 or above\r\n- Please upgrade to FortiOS-6K7K version 6.4.10 or above\r\n- Please upgrade to FortiOS-6K7K version 6.2.12 or above\r\n- Please upgrade to FortiOS-6K7K version 6.0.15 or above",
