Fortinet RCE Vulnerability Effects FortiGate Firewalls

Fortinet has announced that a critical FortiOS SSL VPN vulnerability may have been exploited in recent cyber-attacks. The Remote Code Execution (RCE) vulnerability enables attackers to control a device remotely with the execution of arbitrary code.

Fortinet’s FortiGate firewalls are widely used across a range of organizations, including government, business, and infrastructure sectors, which all have become targets of this vulnerability.

Security researchers identified and are tracking the vulnerability as CVE-2023-27997. It was discovered during a code audit of the SSL-VPN module following another recent set of attacks against government organizations exploiting a FortiOS SSL-VPN zero-day vulnerability.

The RCE (CVE-2023-27997) affects the SSL VPN functionalities of FortiGate firewalls. It can be exploited if Multi-Factor Authentication (MFA) is used or not.

An SSL VPN (Secure Sockets Layer Virtual Private Network) allows remote users to access restricted network resources via an authenticated private pathway by encrypting all communication to and from particular destinations. This makes SSL VPNs critical for businesses that require remote and private access for their employees.

Fortinet has reported active exploitation of this vulnerability. Although a patch is now available, many devices remain vulnerable. These include older devices and units where the owners are not aware a patch is required.

Acreto Solution

Acreto addresses this challenge with:

• Acreto’s solution eliminates internet and internal attack surfaces by providing segmented and isolated data flows among authorized systems and applications. It supports Micro-Segmentation and Nano-Segmentation to limit access only to other authorized Ecosystem members, effectively controlling who can interoperate with the systems.

• Acreto’s Encrypted Secure Scan decrypts, scans, and re-encrypts communications inline and in real-time. This functionality ensures that even if a vulnerability like CVE-2023-27997 exists, any malicious content within encrypted communications is blocked before reaching its final destination.

• Acreto’s solution also provides access control. It authorizes access based on the user’s identity with MFA, device identity, network protocol, application protocol, and even application program. This comprehensive approach to access control further strengthens the defense against any possible exploits of the RCE vulnerability.

• Implementing Acreto’s solution is both simple and sustainable. The provision of an Ecosystem takes only a few minutes and doesn’t have hardware dependencies or related logistical challenges. This makes it an excellent solution for addressing immediate security concerns like CVE-2023-27997 and future-proofing your organization’s security.

Contact Acreto today for more information or to evaluate Ecosystem security for your organization.

Ecosystem Security Isolation

Ecosystems deliver a dedicated security infrastructure that can be deployed per application, use-case, project or third-party. An Ecosystem inherently limits access only to users, devices, systems and applications that need to interoperate together.

Ecosystems support any technology, on any network, anywhere in the world. These include computers, mobile devices, IoTs, Offices, Clouds, SaaS and Data Centers.

Ecosystems can be configured as:

Eliminate the Internet Attack Surface

Eliminates any and all access from the Internet while Ecosystem members can interoperate with authorized systems and applications.

Eliminate the Internal Attack Surface

Ecosystems can easily isolate individual or groups of systems on a shared network or entire networks, to limit access only to systems that need to interoperate together. This is done with

• Micro-Segmentation Segmenting groups of systems on any shared network, including hostile networks or the entire network.

• Nano-Segmentation Isolating an individual system, device or application to limit access only to other authorized Ecosystem members.

Isolated Data Flows

Isolated data flows can be defined between two Ecosystem members to limit access to specified sources and destinations, network protocols and ports, application protocols as well as application programs.

Encrypted Secure Scan

Secure Scan addresses a key weakness in many security tools today. 90%+ of all communications is encrypted, yet only 10% of organizations have the means to secure these communications. Encrypted Secure Scan decrypts, scans, and re-encrypts communications inline and in real-time.

Any malicious content embedded in the encrypted payload is blocked, otherwise the clean and validated communication is delivered to its final destination.

Controls

• User Authorizes access to the Ecosystem by a user’s identity, including MFA, as authenticated by the organizations’ Directory Services such as Active Directory or LDAP, as well as third-party Identity Service Providers such as Okta, Ping, Duo, and CloudJump among others.

• Device Specifies a unique identity to each device to validate that a specified device that does not rely on a user to operate – such as an autonomous application or IoT, is allowed to join the Ecosystem.

• Credit Cards Upload / Download Controls

• Social Security Number Upload / Download Controls

• RegEx Pattern Upload / Download Controls

Threat Prevention

After verification of the network protocol, port, application protocol and application program, a deep inspection is performed on all communications. The effectiveness of this method is amplified by inline Encrypted Secure Scan. Threat prevention capabilities utilize two key methods:

Simplicity

Acreto Ecosystems are very easy to provision and deploy. There are no hardware dependencies or associated logistics.

Provisioning an Ecosystem takes 3-5 minutes. Simply provide a unique name to the Ecosystem then choose the bandwidth desired and within a few minutes your Ecosystem providing a dedicated security infrastructure is ready.

Depending on your connection options for Ecosystem members, deployment can take between 10 minutes to a few hours.

Sustainability

Acreto Ecosystems utilize a sustainable model without any dependency on products and their associated logistics. There are no more updates, upgrades or technology refreshes.

Change Management

Different Ecosystems operate completely independently from one another. Therefore, change management impacts only members of a specified Ecosystem, not the entire organization. This simplifies the traditionally complex change management process.

Policy Management

Policy management also benefits from Ecosystems. Because Ecosystems are specific to a customer scenario such as an application, use-case, project or third-party, all policies apply to the scenario. Moreover, when it’s time for policy cleanup, when an application or use-case is retired, disabling or deleting the Ecosystem automatically prunes the policies. This has traditionally been a complex task that is at best inaccurate.

Mechanism of Attack

• CVE-2023-27997 A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

About Acreto

Acreto delivers full-stack cybersecurity without products, logistics or significant security expertise. It creates and consolidates the best of cybersecurity into a single plug-and-play platform with automated updates to stay ahead of threats. Acreto activates enterprise-grade security instantly, so organizations can run safely, easily, and without interruption.