CVE-2022-40684

What it actually does

CVE-2022-40684 is a critical unauthenticated authentication-bypass vulnerability in the administrative HTTP/HTTPS interfaces of Fortinet FortiOS, FortiProxy, and FortiSwitchManager. By sending specially crafted requests over an alternate path or channel, a remote attacker can perform privileged administrative operations without valid credentials. On affected internet-facing or management-reachable devices, this can allow configuration changes, administrator account manipulation, SSH key insertion, policy modification, traffic interception, and potential device takeover.

Why it matters to the business

Successful exploitation can give an attacker administrative control of perimeter security infrastructure such as firewalls, proxies, and switch-management systems. This can disrupt network operations, weaken security controls, expose sensitive traffic or configuration data, and provide a foothold for broader compromise, including ransomware activity. The vulnerability is listed in CISA KEV, has been used in ransomware campaigns, has an EPSS score near 1.0, and has been actively exploited in the wild for an extended period, so any still-unpatched exposed system should be treated as high risk and potentially compromised.

How an attack unfolds

An attacker first identifies a Fortinet administrative interface exposed to the internet or reachable from a compromised internal network. They then send crafted HTTP or HTTPS requests that abuse the alternate authentication path and are processed as though they came from an authorized administrator. Once accepted, the attacker can execute administrative actions through the management API or web interface, commonly including retrieving configuration, changing device settings, creating or modifying administrator accounts, adding SSH keys, and altering network/security policies. After gaining persistence or control, the attacker may use the device to monitor traffic, disable protections, pivot into internal networks, or support ransomware deployment. Public exploitation has been observed, and threat activity associated with this vulnerability includes campaigns tracked around Fortinet multiple-product authentication bypass exploitation, including StrikeShark-related reporting.

How to fix it

Upgrade affected Fortinet products to a vendor-fixed release immediately. FortiOS versions 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and 7.0.0 through 7.0.6, and FortiSwitchManager versions 7.2.0 and 7.0.0 are affected. If immediate patching is not possible, restrict administrative interfaces to trusted management networks only, disable internet exposure of management HTTP/HTTPS services, enforce local-in policies or firewall rules limiting admin access by source IP, use VPN or dedicated management access paths, and review Fortinet vendor advisories for exact fixed versions and configuration workarounds. Because this vulnerability enables unauthenticated administrative actions, remediation should include credential rotation, administrator account review, SSH key review, and configuration integrity validation, not only software upgrade.

How to confirm the fix worked

Confirm that no FortiOS, FortiProxy, or FortiSwitchManager system remains on an affected version: FortiOS 7.2.0-7.2.1 or 7.0.0-7.0.6; FortiProxy 7.2.0 or 7.0.0-7.0.6; FortiSwitchManager 7.2.0 or 7.0.0. Verify administrative HTTP/HTTPS interfaces are not exposed to the public internet and are reachable only from approved management sources. Review running configuration for unexpected administrator accounts, added SSH public keys, changed local-in policies, modified firewall/proxy policies, altered routing, changed logging destinations, and unexpected automation or API settings. Validate from an external vantage point that management ports are closed or filtered. After upgrade, perform authenticated administrative testing to ensure normal access works and unauthenticated requests cannot perform privileged operations.

Typical attack path

1. Scan for FortiOS, FortiProxy, or FortiSwitchManager administrative HTTP/HTTPS interfaces exposed to the internet or reachable management networks.
2. Fingerprint the product and version to identify systems running affected FortiOS 7.2.0-7.2.1 or 7.0.0-7.0.6, FortiProxy 7.2.0 or 7.0.0-7.0.6, or FortiSwitchManager 7.2.0 or 7.0.0.
3. Send specially crafted unauthenticated HTTP/HTTPS requests to the administrative interface that trigger the authentication bypass.
4. Perform privileged administrative operations without valid credentials.
5. Create or modify administrator access, insert SSH keys, or change device configuration for persistence.
6. Exfiltrate configuration data, weaken firewall/proxy controls, intercept or reroute traffic, and pivot deeper into the network.
7. Use the compromised infrastructure to support follow-on intrusion activity, including ransomware deployment.

How to detect it

Review Fortinet event, system, administrator, and configuration-change logs, as well as reverse proxy, firewall, VPN, and SIEM telemetry covering access to management interfaces. Look for administrative actions from unknown or external IP addresses, admin sessions without expected login events, sudden creation or modification of administrator accounts, added SSH public keys, configuration changes outside maintenance windows, changes to local-in policies or trusted hosts, disabled logging, altered firewall/proxy rules, and unexpected firmware or automation activity. Pay special attention to HTTP/HTTPS requests to administrative endpoints containing headers or request patterns associated with public exploitation, including spoofed management-plane headers such as Forwarded, X-Forwarded-For, and User-Agent values pretending to be trusted internal Fortinet components. For suspected compromise, compare current configuration to known-good backups, export and inspect admin users and SSH keys, and review network telemetry for post-exploitation access from the appliance to internal systems. Because exploitation has been associated with ransomware campaigns and long-running public exploitation, include retrospective searches from October 2022 onward where log retention permits.

• User-Agent: Report Runner
• Forwarded: for="[127.0.0.1]:8888";by="[127.0.0.1]:8888"
• X-Forwarded-For: 127.0.0.1
• /api/v2/cmdb/system/admin
• /api/v2/monitor/system/config/backup
• /api/v2/cmdb/system/admin/admin
• /api/v2/cmdb/system/admin/*/ssh-public-key1
• /api/v2/cmdb/system/admin/*/ssh-public-key2
• /api/v2/cmdb/system/admin/*/ssh-public-key3
• PUT /api/v2/cmdb/system/admin
• POST /api/v2/cmdb/system/admin
• GET /api/v2/monitor/system/config/backup
• "Report Runner"
• "Forwarded" "127.0.0.1" "8888"
• "X-Forwarded-For" "127.0.0.1"
• "ssh-public-key1"
• "ssh-public-key2"
• "ssh-public-key3"

What your security team should do

• Immediately inventory all FortiOS, FortiProxy, and FortiSwitchManager deployments, including internet-facing and internally reachable management interfaces.
• Prioritize emergency remediation for any affected version, especially devices with administrative HTTP/HTTPS exposed outside a restricted management network.
• Treat exposed affected devices as potentially compromised because the vulnerability is in CISA KEV, has a past remediation deadline of 2022-11-01, has active in-the-wild exploitation, ransomware association, and extremely high EPSS likelihood.
• Apply vendor-fixed firmware or software versions and implement management-plane access restrictions as a compensating control.
• Review all administrator accounts, API users, SSH keys, trusted hosts, local-in policies, firewall/proxy policies, routing, and logging configuration for unauthorized changes.
• Rotate administrative passwords, API tokens, VPN/shared secrets, and other credentials stored on or managed by affected devices if compromise cannot be ruled out.
• Search historical logs and SIEM data for unauthenticated administrative API access, suspicious configuration changes, unexpected admin creation, and management access from unfamiliar IP addresses.
• Preserve device logs and configuration snapshots before reimaging or rebuilding systems where compromise is suspected.
• Monitor for follow-on activity from compromised perimeter devices, including unusual outbound connections, lateral movement, disabled security policies, or ransomware precursor behavior.