CVE-2024-50566 — A improper neutralization of special elements used in an os command ('os command injection') vulnerability in…

Summary

Multiple vulnerabilities have been discovered in Fortinet products. They allow an attacker to cause remote arbitrary code execution and a security policy bypass. Fortinet indicates that the CVE-2024-55591 vulnerability is actively exploited.

Recommendation

Refer to the vendor's security bulletin to obtain patches (see Documentation section).

Summary

[Update of 14 January 2025] Publication of patches On 14 January 2025, Fortinet published a security advisory relating to vulnerability CVE-2024-50566, which corresponds to the zero-day vulnerability for which a proof of concept was published in November 2024. Security patches are now available and must be applied. [Update of 15 November 2024] The CERT-FR is aware of a zero-day vulnerability not covered by patch FG-IR-24-423. On 14 November 2024, the CERT-FR became aware of a public proof of concept enabling the exploitation of a zero-day vulnerability affecting all FortiManager and FortiAnalyzer equipment with the FortiManager functionality. This vulnerability allows an attacker controlling a registered FortiGate device to take control of the Forti

Recommendation

The vendor proposes several workarounds if the update cannot be applied immediately. These vary depending on the equipment version and may cause side effects or even be bypassed in certain situations. [Update of 14 January 2025] Publication of patches On 14 January 2025, Fortinet published a security advisory regarding vulnerability CVE-2024-50566. Security updates are available and must be applied. Please refer to the vendor advisory (FG-IR-24-463) for the list of patched versions. [Update of 24 October 2024] Clarifications regarding CERT-FR recommendations. CERT-FR does not rule out the possibility of exploitations carried out in the months preceding the publication of the vendor advisory. It is therefore necessary to search for the indicators of compromise provided by the vendor over a corresponding time period. CERT-FR also recommends conducting a search using the indicators detailed in Mandiant’s blog post [4]. *Note: These indicators have not been qualified by CERT-FR.* Risks of exploitation from within the information system via a previously compromised device or an application relay are possible. CERT-FR therefore recommends conducting a compromise search on devices not exposed to the Internet. In case of compromise or suspected compromise: * report the incident to CERT-FR, copying any relevant sectoral CSIRTs; * search for all traces of lateral movement across the rest of the information system, notably: * by looking for connections or connection attempts to the Internet from the compromised device; * then by searching for these destination IP addresses to check if other machines have ...