# MA-894.122022: MyCERT Advisory - Fortinet Authentication Bypass Vulnerability

**Date:** 02 Dec 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-894.122022  
**Advisory ID:** MA-894.122022

---

**1.0 Introduction**
Fortinet released a security advisory regarding the [CVE-2022-40684](https://www.fortiguard.com/psirt/FG-IR-22-377) vulnerability that is affecting multiple Fortinet devices and services.
**2.0 Impact**
An authentication bypass using an alternate path or channel vulnerability [CWE-288] in FortiOS, FortiProxy, and FortiSwitchManager may allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
**3.0 Affected Products**
- FortiOS version 7.2.0 through 7.2.1
- FortiOS version 7.0.0 through 7.0.6
- FortiProxy version 7.2.0
- FortiProxy version 7.0.0 through 7.0.6
- FortiSwitchManager version 7.2.0
- FortiSwitchManager version 7.0.0
- FortiOS versions 5.x, 6.x are NOT impacted.
**4.0 Indicators of CompromiseExploitation Status:**
- Fortinet is aware of an instance where this vulnerability was exploited and recommends immediately validating your systems against the following indicator of compromise in the device's logs:
*user="Local\_Process\_Access"*
Please contact customer support for assistance.
- Fortinet is aware of instances where this vulnerability was exploited to download the config file from the targeted devices and to add a malicious super\_admin account called  "fortigate-tech-support":
*# show system adminedit "fortigate-tech-support"set accprofile "super\_admin"set vdom "root"set password ENC [...]next*
Please contact customer support for assistance.
**Workaround:**
- **FortiOS:**
Disable HTTP/HTTPS administrative interface
OR
Limit IP addresses that can reach the administrative interface:
*config firewall addressedit "my\_allowed\_addresses"set subnet <MY IP> <MY SUBNET>end*
Then create an Address Group:
*config firewall addrgrpedit "MGMT\_IPs"set member "my\_allowed\_addresses"end*
Create the Local in Policy to restrict access only to the predefined group on the management interface (here:               port1):
*config firewall local-in-policyedit 1set intf port1set srcaddr "MGMT\_IPs"set dstaddr "all"set action acceptset service HTTPS HTTPset schedule "always"set status enablenextedit 2set intf "any"set srcaddr "all"set dstaddr "all"set action denyset service HTTPS HTTPset schedule "always"set status enableend*
If using non-default ports, create an appropriate service object for GUI administrative access:
*config firewall service customedit GUI\_HTTPSset tcp-portrange <admin-sport>nextedit GUI\_HTTPset tcp-portrange <admin-port>end*
Use these objects instead of "HTTPS HTTP "in the local-in policy 1 and 2 below.
UPDATE: When using an HA reserved management interface, the local in policy needs to be configured
slightly differently - please see: <https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to->
[configure-a-local-in-policy-on-a-HA/ta-p/222005](https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-a-local-in-policy-on-a-HA/ta-p/222005)
Please contact customer support for assistance.
- **FortiProxy:**
Disable HTTP/HTTPS administrative interface
OR
For FortiProxy VM, all versions of FortiProxy appliance 7.0.6:
Limit IP addresses that can reach the administrative interface (here: port1):
*config system interfaceedit port1set dedicated-to managementset trust-ip-1 <MY IP> <MY SUBNET>end*
Please contact customer support for assistance.
- **FortiSwitchManager:**
Disable HTTP/HTTPS administrative interface
Please contact customer support for assistance.
**5.0 Recommendations**
MyCERT recommends that customers validate their configuration to ensure that no unauthorized changes have been implemented by a malicious third party, regardless of whether they have upgraded. 
MyCERT also strongly recommend system administrators follow the update steps below:
- Please upgrade to FortiOS version 7.2.2 or above
- Please upgrade to FortiOS version 7.0.7 or above
- Please upgrade to FortiProxy version 7.2.1 or above
- Please upgrade to FortiProxy version 7.0.7 or above
- Please upgrade to FortiSwitchManager version 7.2.1 or above
- Please upgrade to FortiSwitchManager version 7.0.1 or above
- Please upgrade to FortiOS version 7.0.5 B8001 or above for **FG6000F and 7000E/F** series platforms
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.fortiguard.com/psirt/FG-IR-22-377>
- <http://blog.cyble.com/>