A critical vulnerability in FortiOS SSL-VPN has been confirmed to be exploited in the wild by Fortinet. FortiGuard Labs, the threat and research branch of Fortinet, have published a security advisory this week warning users to immediately validate their systems against the list of indicators of compromise (IoC) which can be found in the security advisory to determine whether they have been hacked. Multiple versions of FortiOS and FortiOS-6K7K are affected by this actively exploited vulnerability, however Fortinet have released a range of patched versions to support these affected products.  

The exploited critical severity flaw is a heap-based buffer overflow vulnerability. Tracked as CVE-2022-42475, this vulnerability has been given a CVSS base score of 9.3 because of the severe impact of an exploit, which can result in code execution. This vulnerability affects the FortiOS sslvpnd, where the buffer can be overwritten and allocated incorrectly to heap memory, possibly via a routine, although full detail about an exploit of this flaw has not yet been released. This buffer overflow allows for a remote, unauthenticated attacker to execute arbitrary code in the application, or to send commands using specifically crafted requests. 

Users of FortiOS versions 7.2.0 – 7.2.2, 7.0.0 – 7.0.8, 6.4.0 – 6.4.10, 6.2.0 – 6.2.11, 6.0.0 – 6.0.15, 5.6.0 – 5.6.14, 5.4.0 – 5.4.13, 5.2.0 – 5.2.15, and 5.0.0 – 5.0.14, and FortiOS-6K7K versions 7.0.0 – 7.0.7, 6.4.0 – 6.4.9, 6.2.0 – 6.2.11, and 6.0.0 – 6.0.14 are affected by this vulnerability. Disabling the SSL-VPN on an affected product is a sufficient workaround to prevent exploit. Further security steps can be taken such as monitoring logs and creating access rule to limit connections to specific IP addresses, however this is not a sufficient long-term solution to this flaw. Security updates should be applied to upgrade products to a fixed version, which includes FortiOS versions 7.2.3 or above, 7.0.9 or above, 6.4.11 or above, and 6.2.12 or above, and FortiOS-6K7K versions 6.4.10 or above, and 6.0.15 or above. Further patched versions of FortiOS-6K7K 7.0.8 and above, and 6.2.12 and above, are scheduled for upcoming release.