Fortigate firewalls – Vulnerable to a critical RCE Flaw

The latest research shows Fortigate firewalls are vulnerable to remote code execution attempts.

490,000 affected SSL VPN interfaces are exposed on the internet, and roughly 69% are currently unpatched.

Bishop Fox internally developed an exploit for CVE-2023-27997, a heap overflow in FortiOS—the OS behind FortiGate firewalls—that allows remote code execution. 

CVE-2023-27997 is a heap-based buffer overflow in FortiGate’s SSL VPN component, which has been demonstrated to be exploitable for pre-authentication RCE.

Fortinet Firewall Exploit

The exploit can smash the heap, connect back to an attacker-controlled server, download a BusyBox binary, and open an interactive shell. 

This exploit very closely follows the steps detailed in the original blog post by Lexfo, which runs in approximately one second.

Below query on Shodan CLI returns nearly 490,000 exposed SSL VPN interfaces issued to Fortigate Firewall.

$ shodan count '"Server: xxxxxxxx-xxxxx" http.html: "top.location=/remote/login"'
489337

335,923 Unpatched Devices

Below, a search on Shodan for the last two months in the Last-Modified HTTP response header can find devices that’ve been patched.

In the following query, we assume that half of the devices with May-based installations are patched (there are some overlapping versions in this timeframe), and all of the June-based installations are patched.

According to the results, only 153,414 devices on the internet are patched, which leaves 335,923 / 489,337 = 69% unpatched.

Further analysis of the team has revealed that there are lots of version 7 (released in early 2021) and a ton of version 6, which is gradually reaching the end of its life.

“AI-based email security measures Protect your business From Email Threats!” – Request a Free Demo.