From aad3a35478e85946bc57fd67254fec47ae9f972e Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 14 Oct 2022 12:19:26 -0600 Subject: [PATCH 1/9] Drop a Forti --- .../web/fortinet_appliance_auth_bypass.yml | 75 +++++++++++++++++++ ...2_40684_fortinet_appliance_auth_bypass.yml | 20 +++++ 2 files changed, 95 insertions(+) create mode 100644 detections/experimental/web/fortinet_appliance_auth_bypass.yml create mode 100644 stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml diff --git a/detections/experimental/web/fortinet_appliance_auth_bypass.yml b/detections/experimental/web/fortinet_appliance_auth_bypass.yml new file mode 100644 index 0000000000..3befa5e2e5 --- /dev/null +++ b/detections/experimental/web/fortinet_appliance_auth_bypass.yml @@ -0,0 +1,75 @@ +name: Fortinet Appliance Auth bypass +id: a83122f2-fa09-4868-a230-544dbc54bc1c +version: 1 +date: '2022-10-14' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Web +description: 'CVE-2022-40684 is a Fortinet appliance auth bypass that is actively being exploited and a POC is released publicy. The POC adds a SSH key to the appliance. Note that the exploit can be used with any HTTP method (GET, POST, PUT, DELETE, etc). The REST API request failing is not an indication that an attacker was unsuccessful. Horizon3 was able to modify the admin SSH keys though a REST API request that reportedly failed. + The collection /api/v2/ endpoints can be used to configure the system and modify the administrator user. Any logs found that meet the above conditions and also have a URL containing /api/v2/ should be cause for concern. Further investigation of any matching log entries can reveal any damage an attack has done. Additionally, an attacker may perform the following actions to further compromise a system + Modify the admin users’ SSH keys to enable the attacker to login to the compromised system. \ + + Add new local users. \ + Update networking configurations to reroute traffic. \ + + Download the system configuration. \ + + Initiate packet captures to capture other sensitive system information. Reference Horizon3.ai' +search: '| tstats count min(_time) as firstTime max(_time) + as lastTime from datamodel=Web where Web.url IN ("*//api//v2//cmdb//system//admin//admin*") Web.http_method IN ("GET", "PUT") + by Web.http_user_agent, Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `fortinet_appliance_auth_bypass_filter`' +how_to_implement: This detection requires the Web datamodel to be populated from a + supported Technology Add-On like Splunk for Apache. Splunk for Nginx, or Splunk for Palo Alto. +known_false_positives: GET requests will be noisy and need to be filtered out or removed from the query based on volume. Filter as needed. +references: + - https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/ + - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/ + - https://github.com/horizon3ai/CVE-2022-40684 + - https://www.horizon3.ai/fortinet-iocs-cve-2022-40684/ +tags: + analytic_story: + - CVE-2022-40684 Fortinet Appliance Auth bypass + asset_type: Network + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Application Log + - Stage:Execution + dataset: [] + impact: 90 + kill_chain_phases: + - Exploitation + message: Potential CVE-2022-40684 against a Fortinet appliance may be occurring against $dest$. + mitre_attack_id: + - T1190 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + cve: + - CVE-2022-40684 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Web.http_user_agent + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + - sourcetype + risk_score: 81 + security_domain: network diff --git a/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml new file mode 100644 index 0000000000..72aa67ac8b --- /dev/null +++ b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml @@ -0,0 +1,20 @@ +name: CVE-2022-40684 Fortinet Appliance Auth bypass +id: 55721831-577e-41be-beef-bdc03c81486a +version: 1 +date: '2022-10-14' +author: Michael Haag, Splunk +description: Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects (CVE-2022-40684). +narrative: FortiOS exposes a management web portal that allows a user configure the system. Additionally, a user can SSH into the system which exposes a locked down CLI interface. Any HTTP requests to the management interface of the system that match the conditions above should be cause for concern. An attacker can use this vulnerability to do just about anything they want to the vulnerable system. This includes changing network configurations, adding new users, and initiating packet captures. Note that this is not the only way to exploit this vulnerability and there may be other sets of conditions that work. For instance, a modified version of this exploit uses the User-Agent “Node.js”. This exploit seems to follow a trend among recently discovered enterprise software vulnerabilities where HTTP headers are improperly validated or overly trusted. (ref Horizon3.ai) +references: + - https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/ + - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/ + - https://github.com/horizon3ai/CVE-2022-40684 +tags: + analytic_story: CVE-2022-40684 Fortinet Appliance Auth bypass + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 363677cc7112195c14feb14638977f298c0bc9a0 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 14 Oct 2022 12:26:35 -0600 Subject: [PATCH 2/9] Update cve_2022_40684_fortinet_appliance_auth_bypass.yml --- stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml index 72aa67ac8b..bf66f8b689 100644 --- a/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml +++ b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml @@ -3,8 +3,8 @@ id: 55721831-577e-41be-beef-bdc03c81486a version: 1 date: '2022-10-14' author: Michael Haag, Splunk -description: Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects (CVE-2022-40684). -narrative: FortiOS exposes a management web portal that allows a user configure the system. Additionally, a user can SSH into the system which exposes a locked down CLI interface. Any HTTP requests to the management interface of the system that match the conditions above should be cause for concern. An attacker can use this vulnerability to do just about anything they want to the vulnerable system. This includes changing network configurations, adding new users, and initiating packet captures. Note that this is not the only way to exploit this vulnerability and there may be other sets of conditions that work. For instance, a modified version of this exploit uses the User-Agent “Node.js”. This exploit seems to follow a trend among recently discovered enterprise software vulnerabilities where HTTP headers are improperly validated or overly trusted. (ref Horizon3.ai) +description: Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects CVE-2022-40684. +narrative: FortiOS exposes a management web portal that allows a user configure the system. Additionally, a user can SSH into the system which exposes a locked down CLI interface. Any HTTP requests to the management interface of the system that match the conditions above should be cause for concern. An attacker can use this vulnerability to do just about anything they want to the vulnerable system. This includes changing network configurations, adding new users, and initiating packet captures. Note that this is not the only way to exploit this vulnerability and there may be other sets of conditions that work. For instance, a modified version of this exploit uses the User-Agent Node.js. This exploit seems to follow a trend among recently discovered enterprise software vulnerabilities where HTTP headers are improperly validated or overly trusted. (ref Horizon3.ai) references: - https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/ - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/ @@ -17,4 +17,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection + usecase: Advanced Threat Detection \ No newline at end of file From 5e6be8b499789d1bc725db69499675a203be8f09 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 14 Oct 2022 12:49:28 -0600 Subject: [PATCH 3/9] Update fortinet_appliance_auth_bypass.yml --- detections/experimental/web/fortinet_appliance_auth_bypass.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/experimental/web/fortinet_appliance_auth_bypass.yml b/detections/experimental/web/fortinet_appliance_auth_bypass.yml index 3befa5e2e5..a51c1ef9dc 100644 --- a/detections/experimental/web/fortinet_appliance_auth_bypass.yml +++ b/detections/experimental/web/fortinet_appliance_auth_bypass.yml @@ -8,7 +8,7 @@ datamodel: - Web description: 'CVE-2022-40684 is a Fortinet appliance auth bypass that is actively being exploited and a POC is released publicy. The POC adds a SSH key to the appliance. Note that the exploit can be used with any HTTP method (GET, POST, PUT, DELETE, etc). The REST API request failing is not an indication that an attacker was unsuccessful. Horizon3 was able to modify the admin SSH keys though a REST API request that reportedly failed. The collection /api/v2/ endpoints can be used to configure the system and modify the administrator user. Any logs found that meet the above conditions and also have a URL containing /api/v2/ should be cause for concern. Further investigation of any matching log entries can reveal any damage an attack has done. Additionally, an attacker may perform the following actions to further compromise a system - Modify the admin users’ SSH keys to enable the attacker to login to the compromised system. \ + Modify the admin SSH key to enable the attacker to login to the compromised system. \ Add new local users. \ Update networking configurations to reroute traffic. \ From d7f115f0c72a5b844d827bdd4b43f4818fe74cf9 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 14 Oct 2022 13:08:10 -0600 Subject: [PATCH 4/9] Update fortinet_appliance_auth_bypass.yml --- detections/experimental/web/fortinet_appliance_auth_bypass.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/experimental/web/fortinet_appliance_auth_bypass.yml b/detections/experimental/web/fortinet_appliance_auth_bypass.yml index a51c1ef9dc..edc878082a 100644 --- a/detections/experimental/web/fortinet_appliance_auth_bypass.yml +++ b/detections/experimental/web/fortinet_appliance_auth_bypass.yml @@ -11,6 +11,7 @@ description: 'CVE-2022-40684 is a Fortinet appliance auth bypass that is activel Modify the admin SSH key to enable the attacker to login to the compromised system. \ Add new local users. \ + Update networking configurations to reroute traffic. \ Download the system configuration. \ From c8f1c872032e0e93ce48f6ca184ace7d644e559e Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 14 Oct 2022 13:12:10 -0600 Subject: [PATCH 5/9] update --- detections/experimental/web/fortinet_appliance_auth_bypass.yml | 3 ++- stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/detections/experimental/web/fortinet_appliance_auth_bypass.yml b/detections/experimental/web/fortinet_appliance_auth_bypass.yml index edc878082a..d0207d575f 100644 --- a/detections/experimental/web/fortinet_appliance_auth_bypass.yml +++ b/detections/experimental/web/fortinet_appliance_auth_bypass.yml @@ -11,7 +11,7 @@ description: 'CVE-2022-40684 is a Fortinet appliance auth bypass that is activel Modify the admin SSH key to enable the attacker to login to the compromised system. \ Add new local users. \ - + Update networking configurations to reroute traffic. \ Download the system configuration. \ @@ -32,6 +32,7 @@ references: - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/ - https://github.com/horizon3ai/CVE-2022-40684 - https://www.horizon3.ai/fortinet-iocs-cve-2022-40684/ + - https://attackerkb.com/topics/QWOxGIKkGx/cve-2022-40684/rapid7-analysis tags: analytic_story: - CVE-2022-40684 Fortinet Appliance Auth bypass diff --git a/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml index bf66f8b689..3d2f422c2c 100644 --- a/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml +++ b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml @@ -9,6 +9,7 @@ references: - https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/ - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/ - https://github.com/horizon3ai/CVE-2022-40684 + - https://attackerkb.com/topics/QWOxGIKkGx/cve-2022-40684/rapid7-analysis tags: analytic_story: CVE-2022-40684 Fortinet Appliance Auth bypass category: From 744dd3c71338c9948b8ca1d20437c41810aeda19 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Sat, 15 Oct 2022 06:43:09 -0600 Subject: [PATCH 6/9] Data add to Forti --- .../web/fortinet_appliance_auth_bypass.yml | 7 ++++--- tests/web/fortinet_appliance_auth_bypass.test.yml | 13 +++++++++++++ 2 files changed, 17 insertions(+), 3 deletions(-) rename detections/{experimental => }/web/fortinet_appliance_auth_bypass.yml (83%) create mode 100644 tests/web/fortinet_appliance_auth_bypass.test.yml diff --git a/detections/experimental/web/fortinet_appliance_auth_bypass.yml b/detections/web/fortinet_appliance_auth_bypass.yml similarity index 83% rename from detections/experimental/web/fortinet_appliance_auth_bypass.yml rename to detections/web/fortinet_appliance_auth_bypass.yml index d0207d575f..22b35ef566 100644 --- a/detections/experimental/web/fortinet_appliance_auth_bypass.yml +++ b/detections/web/fortinet_appliance_auth_bypass.yml @@ -18,7 +18,7 @@ description: 'CVE-2022-40684 is a Fortinet appliance auth bypass that is activel Initiate packet captures to capture other sensitive system information. Reference Horizon3.ai' search: '| tstats count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where Web.url IN ("*//api//v2//cmdb//system//admin//admin*") Web.http_method IN ("GET", "PUT") + as lastTime from datamodel=Web where Web.url IN ("*/api/v2/cmdb/system/admin/admin*") Web.http_method IN ("GET", "PUT") by Web.http_user_agent, Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` @@ -26,7 +26,7 @@ search: '| tstats count min(_time) as firstTime max(_time) | `fortinet_appliance_auth_bypass_filter`' how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache. Splunk for Nginx, or Splunk for Palo Alto. -known_false_positives: GET requests will be noisy and need to be filtered out or removed from the query based on volume. Filter as needed. +known_false_positives: GET requests will be noisy and need to be filtered out or removed from the query based on volume. Restrict analytic to known publically facing Fortigates, or run analytic as a Hunt until properly tuned. It is also possible the user agent may be filtered on Report Runner only for the exploit, however, it is unknown at this if other user agents may be used. references: - https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/ - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/ @@ -45,7 +45,8 @@ tags: context: - Source:Application Log - Stage:Execution - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/fortigate/fortinetcve202240684.log impact: 90 kill_chain_phases: - Exploitation diff --git a/tests/web/fortinet_appliance_auth_bypass.test.yml b/tests/web/fortinet_appliance_auth_bypass.test.yml new file mode 100644 index 0000000000..b5d9a7d56d --- /dev/null +++ b/tests/web/fortinet_appliance_auth_bypass.test.yml @@ -0,0 +1,13 @@ +name: Fortinet Appliance Auth bypass Unit Test +tests: +- name: Fortinet Appliance Auth bypass + file: web/fortinet_appliance_auth_bypass.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: fortinetcve202240684.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/fortigate/fortinetcve202240684.log + source: pan:threat + sourcetype: pan:threat + update_timestamp: true From fafef8158fd6f24ebad04c9fc1325b6c297de418 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 17 Oct 2022 07:51:14 -0600 Subject: [PATCH 7/9] reference --- stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml index 3d2f422c2c..91f8449141 100644 --- a/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml +++ b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml @@ -10,6 +10,7 @@ references: - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/ - https://github.com/horizon3ai/CVE-2022-40684 - https://attackerkb.com/topics/QWOxGIKkGx/cve-2022-40684/rapid7-analysis + - https://www.greynoise.io/blog/fortios-authentication-bypass tags: analytic_story: CVE-2022-40684 Fortinet Appliance Auth bypass category: From 6ac9e6e08e04451abe1084c320e87df4ceb9c558 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 17 Oct 2022 07:56:05 -0600 Subject: [PATCH 8/9] reference to MSF --- detections/web/fortinet_appliance_auth_bypass.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/web/fortinet_appliance_auth_bypass.yml b/detections/web/fortinet_appliance_auth_bypass.yml index 22b35ef566..b327013974 100644 --- a/detections/web/fortinet_appliance_auth_bypass.yml +++ b/detections/web/fortinet_appliance_auth_bypass.yml @@ -33,6 +33,7 @@ references: - https://github.com/horizon3ai/CVE-2022-40684 - https://www.horizon3.ai/fortinet-iocs-cve-2022-40684/ - https://attackerkb.com/topics/QWOxGIKkGx/cve-2022-40684/rapid7-analysis + - https://github.com/rapid7/metasploit-framework/pull/17143 tags: analytic_story: - CVE-2022-40684 Fortinet Appliance Auth bypass From 1cc9c2dce0eae806de501d6a0d96807465448924 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 Oct 2022 08:30:54 -0600 Subject: [PATCH 9/9] update query --- detections/web/fortinet_appliance_auth_bypass.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/web/fortinet_appliance_auth_bypass.yml b/detections/web/fortinet_appliance_auth_bypass.yml index b327013974..6498013ff5 100644 --- a/detections/web/fortinet_appliance_auth_bypass.yml +++ b/detections/web/fortinet_appliance_auth_bypass.yml @@ -18,7 +18,7 @@ description: 'CVE-2022-40684 is a Fortinet appliance auth bypass that is activel Initiate packet captures to capture other sensitive system information. Reference Horizon3.ai' search: '| tstats count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where Web.url IN ("*/api/v2/cmdb/system/admin/admin*") Web.http_method IN ("GET", "PUT") + as lastTime from datamodel=Web where Web.url IN ("*/api/v2/cmdb/system/admin*") Web.http_method IN ("GET", "PUT") by Web.http_user_agent, Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` @@ -26,7 +26,7 @@ search: '| tstats count min(_time) as firstTime max(_time) | `fortinet_appliance_auth_bypass_filter`' how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache. Splunk for Nginx, or Splunk for Palo Alto. -known_false_positives: GET requests will be noisy and need to be filtered out or removed from the query based on volume. Restrict analytic to known publically facing Fortigates, or run analytic as a Hunt until properly tuned. It is also possible the user agent may be filtered on Report Runner only for the exploit, however, it is unknown at this if other user agents may be used. +known_false_positives: GET requests will be noisy and need to be filtered out or removed from the query based on volume. Restrict analytic to known publically facing Fortigates, or run analytic as a Hunt until properly tuned. It is also possible the user agent may be filtered on Report Runner or Node.js only for the exploit, however, it is unknown at this if other user agents may be used. references: - https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/ - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/