Analysis from the Intruder Security Team
Published Oct 24, 2024
For an instance of FortiManager to be exploitable by this vulnerability (FortiJump), the FGFM protocol (tcp/541 or tcp/542 if using IPv6) needs to be exposed to the internet, either by the FortiManager instance or a FortiGate device which is connected to a vulnerable FortiManager instance. This is because the FGFM protocol can allow access to FortiManager devices which are behind NAT if a FortiGate product is exposed to the internet and has FGFM enabled.
FGFM needs to be enabled, this is now disabled by default following the patch for CVE-2024-23113.
Mandiant have a comprehensive article on this weakness, its use in the wild by threat actors, IOCs and mitigation strategies. Watchtowr have released a second blog explaining the full technical details of this attack. In this post Watchtowr outline how the original mitigations did not fully patch systems against this vulnerability.
Intruder customers can use the attack surface view to find out if they have port tcp/541 exposed to the internet.
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7E60883-7F64-4C22-99F9-802A7623DAE0",
"versionEndExcluding": "6.2.13",
"versionStartIncluding": "6.2.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2AD66B0-9C99-4F83-80AA-B54E6354ADFD",
"versionEndExcluding": "6.4.15",
"versionStartIncluding": "6.4.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37456E27-0EE2-4AF8-B92F-A5284FEC0409",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "7.0.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "01E63E1E-4084-4C73-862F-A4CC07914C23",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "7.2.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0666260A-1327-4C43-A841-04FB4459449C",
"versionEndExcluding": "7.4.5",
"versionStartIncluding": "7.4.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0141F06A-F5FE-4DF3-B60E-DD76A1AD8A56"
},
{
"criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BB52FA5-7811-4123-8989-59369583F82F",
"versionEndIncluding": "6.4.7",
"versionStartIncluding": "6.4.1"
},
{
"criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "29B3A5F2-3121-4902-BBB6-8B4D07767F77",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "7.0.1"
},
{
"criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3A26BF0-DF69-42F6-B9D8-D3BEE3DD352C",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "7.2.1"
},
{
"criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6E0BCF26-B311-4FFF-866B-3DCA14A26268",
"versionEndExcluding": "7.4.5",
"versionStartIncluding": "7.4.1"
}
],
"operator": "OR"
}
]
}
]