CVE-2024-47575 - FortiManager Authentication Bypass

CVE-2024-47575, also known as **FortiJump**, is a critical zero-day vulnerability affecting **FortiManager**, a centralized management platform for Fortinet devices. The vulnerability arises due to missing authentication checks in specific FortiManager REST API endpoints. An unauthenticated attacker with network access to the FortiManager device can exploit this flaw to execute arbitrary code or commands, potentially leading to complete system compromise. --- ## Affected Versions | FortiManager Version | Status | |------------------------|--------------------| | **7.2.0 to 7.2.3** | Affected | | **7.0.0 to 7.0.7** | Affected | | **6.4.0 to 6.4.11** | Affected | | **6.2.x and earlier** | Potentially Affected | | **7.2.4 and above** | **Patched** | | **7.0.8 and above** | **Patched** | | **6.4.12 and above** | **Patched** | *Note:* Old FortiAnalyzer models 1000E, 1000F, 2000E, 3000E, 3000F, 3000G, 3500E, 3500F, 3500G, 3700F, 3700G, 3900E with the following feature enabled (FortiManager on FortiAnalyzer): config system global set fmg-status enable end And at least one interface with the fgfm service enabled is also impacted by this vulnerability. --- ## Playbook Flow 1. Create, Tag, and Block Indicators 2. Hunt **Automatically** for Suspicious Behavior Related to the exploitation flow using XQL **Note: The 'fortinet_fortimanager_raw' dataset must be available for the XQL queries completion.** 3. Provide Mitigations and Workarounds --- **References**: - [Fortinet PSIRT Advisory FG-IR-24-423](https://www.fortiguard.com/psirt/FG-IR-24-423) --- By following this playbook, organizations can effectively respond to and mitigate the risks associated with **CVE-2024-47575 (FortiJump)**.

CVE-2024-47575 - FortiManager Authentication Bypass · 14 tasks · 1 input · 0 outputs

Details

IDCVE-2024-47575 - FortiManager Authentication Bypass
From Version6.10.0
Tasks14
TagsFortiJump CVE-2024-47575 FortiManager Vulnerability

README

CVE-2024-47575, also known as FortiJump, is a critical zero-day vulnerability affecting FortiManager, a centralized management platform for Fortinet devices. The vulnerability arises due to missing authentication checks in specific FortiManager REST API endpoints. An unauthenticated attacker with network access to the FortiManager device can exploit this flaw to execute arbitrary code or commands, potentially leading to complete system compromise.

Affected Versions

FortiManager Version Status
7.2.0 to 7.2.3 Affected
7.0.0 to 7.0.7 Affected
6.4.0 to 6.4.11 Affected
6.2.x and earlier Potentially Affected
7.2.4 and above Patched
7.0.8 and above Patched
6.4.12 and above Patched

Note:

Old FortiAnalyzer models 1000E, 1000F, 2000E, 3000E, 3000F, 3000G, 3500E, 3500F, 3500G, 3700F, 3700G, 3900E with the following feature enabled (FortiManager on FortiAnalyzer):

config system global
set fmg-status enable
end

And at least one interface with the fgfm service enabled is also impacted by this vulnerability.

Playbook Flow

  1. Create, Tag, and Block Indicators

  2. Hunt Automatically for Suspicious Behavior Related to the exploitation flow using XQL
    Note: The ‘fortinet_fortimanager_raw’ dataset must be available for the XQL queries completion.

  3. Provide Mitigations and Workarounds

References:

By following this playbook, organizations can effectively respond to and mitigate the risks associated with CVE-2024-47575 (FortiJump).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • createNewIndicator
  • extractIndicators
  • xdr-xql-generic-query

Playbook Inputs

Name Description Default Value Required
rawIoCs FortiGuard Labs IoCs 195.85.114[.]78, 104.238.141[.]143, 45.32.41[.]202, 158.247.199[.]37, CVE-2024-47575, 0qsc137p@justdefinition[.]com Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

CVE-2024-47575 - FortiManager Authentication Bypass

Inputs

  • rawIoCs — FortiGuard Labs IoCs

Commands used

createNewIndicator extractIndicators xdr-xql-generic-query

Flowchart

yes Start Start Extract indicators from hardcoded input - extractIndicators Extract indicators from h... extractIndicators Create and Tag Indicators Create and Tag Indicators IP Indicators - createNewIndicator IP Indicators createNewIndicator CVE Indicators - createNewIndicator CVE Indicators createNewIndicator XQL Hunting Queries XQL Hunting Queries Unusual configuration changes - xdr-xql-generic-query Unusual configuration cha... xdr-xql-generic-query Known IOCs and post-exploitation artifacts - xdr-xql-generic-query Known IOCs and post-explo... xdr-xql-generic-query Email Indicators - createNewIndicator Email Indicators createNewIndicator Mitigations Mitigations Recommended Mitigations and Workarounds Recommended Mitigations a... Done Done Suspicious activity detected? Suspicious activity detec... Threat Hunting findings acknowledgement Threat Hunting findings a...

Source

playbook-CVE-2024-47575_-_FortiManager_Authentication_Bypass.yml
Download History Raw 
id: CVE-2024-47575 - FortiManager Authentication Bypass
version: -1
name: CVE-2024-47575 - FortiManager Authentication Bypass
description: "CVE-2024-47575, also known as **FortiJump**, is a critical zero-day vulnerability affecting **FortiManager**, a centralized management platform for Fortinet devices. The vulnerability arises due to missing authentication checks in specific FortiManager REST API endpoints. An unauthenticated attacker with network access to the FortiManager device can exploit this flaw to execute arbitrary code or commands, potentially leading to complete system compromise.\n\n---\n\n## Affected Versions\n\n| FortiManager Version   | Status             |\n|------------------------|--------------------|\n| **7.2.0 to 7.2.3**     | Affected           |\n| **7.0.0 to 7.0.7**     | Affected           |\n| **6.4.0 to 6.4.11**    | Affected           |\n| **6.2.x and earlier**  | Potentially Affected |\n| **7.2.4 and above**    | **Patched**        |\n| **7.0.8 and above**    | **Patched**        |\n| **6.4.12 and above**   | **Patched**        |\n\n*Note:*\n\nOld FortiAnalyzer models 1000E, 1000F, 2000E, 3000E, 3000F, 3000G, 3500E, 3500F, 3500G, 3700F, 3700G, 3900E with the following feature enabled (FortiManager on FortiAnalyzer):\n\nconfig system global\nset fmg-status enable\nend\n\nAnd at least one interface with the fgfm service enabled is also impacted by this vulnerability.\n\n---\n\n## Playbook Flow\n\n1. Create, Tag, and Block Indicators\n\n2. Hunt **Automatically** for Suspicious Behavior Related to the exploitation flow using XQL\n**Note: The 'fortinet_fortimanager_raw' dataset must be available for the XQL queries completion.**\n\n3. Provide Mitigations and Workarounds\n\n---\n\n**References**:\n\n- [Fortinet PSIRT Advisory FG-IR-24-423](https://www.fortiguard.com/psirt/FG-IR-24-423)\n\n---\n\nBy following this playbook, organizations can effectively respond to and mitigate the risks associated with **CVE-2024-47575 (FortiJump)**. \n"
tags:
- FortiJump
- CVE-2024-47575
- FortiManager Vulnerability
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e638d977-c697-44e9-8caf-9711598be275
    type: start
    task:
      id: e638d977-c697-44e9-8caf-9711598be275
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 3e555db3-5358-4a2c-8541-3977d0dfa466
    type: regular
    task:
      id: 3e555db3-5358-4a2c-8541-3977d0dfa466
      version: -1
      name: Extract indicators from hardcoded input
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      text:
        simple: ${inputs.rawIoCs}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 23a45588-c954-4d0c-8f0b-61d032408181
    type: title
    task:
      id: 23a45588-c954-4d0c-8f0b-61d032408181
      version: -1
      name: Create and Tag Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
      - "4"
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: be1ec492-d8f8-40cb-804b-c31e573a9f4f
    type: regular
    task:
      id: be1ec492-d8f8-40cb-804b-c31e573a9f4f
      version: -1
      name: IP Indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      tags:
        simple: FortiManager Vulnerability, CVE-2024-47575, FortiJump
      type:
        simple: IP
      value:
        simple: ${ExtractedIndicators.IP}
      verdict:
        simple: Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: cbce2eae-896c-4e8c-894b-a4ffd3d34e4e
    type: regular
    task:
      id: cbce2eae-896c-4e8c-894b-a4ffd3d34e4e
      version: -1
      name: CVE Indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      tags:
        simple: FortiManager Vulnerability, CVE-2024-47575, FortiJump
      type:
        simple: CVE
      value:
        simple: ${ExtractedIndicators.CVE}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 8ab19925-9fbe-4fcd-8b82-a156cf3753d7
    type: title
    task:
      id: 8ab19925-9fbe-4fcd-8b82-a156cf3753d7
      version: -1
      name: XQL Hunting Queries
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 7391477e-4356-4c10-8351-431248a5a355
    type: regular
    task:
      id: 7391477e-4356-4c10-8351-431248a5a355
      version: -1
      name: Unusual configuration changes
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      query:
        simple: "config case_sensitive = false \n| dataset = fortinet_fortimanager_raw \n| filter _raw_log in (\"*Add device*\",\"*Modify device*\")\n| alter elog_changes = regextract(_raw_log, \"changes=\\\"(.*)\\\"\")\n| alter elog_msg = regextract(_raw_log, \"msg=\\\"(.*)\\\"\")"
      query_name:
        simple: FortiManager_CVE-2024-47575_Unusual_Configuration_Changes
      time_frame:
        simple: 90 days ago
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 835
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 3972d968-ea7a-4ef4-8b39-ca3ca0695684
    type: regular
    task:
      id: 3972d968-ea7a-4ef4-8b39-ca3ca0695684
      version: -1
      name: Known IOCs and post-exploitation artifacts
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      query:
        simple: "config case_sensitive = false \n| dataset = fortinet_fortimanager_raw \n| filter _raw_log in (\"*tmp/\",\"*45.32.41.202*\",\"*104.238.141.143*\",\"*158.247.199.37*\",\"*195.85.114.78*\",\"*VMTM23017412*\",\"*Unregistered device localhost add succeeded*\",\"*0qsc137p@justdefinition.com*\",\"*Purity Supreme*\")\n| alter elog_changes = regextract(_raw_log, \"changes=\\\"(.*)\\\"\")\n| alter elog_msg = regextract(_raw_log, \"msg=\\\"(.*)\\\"\")"
      query_name:
        simple: FortiManager_CVE-2024-47575_Known_IoCs
      time_frame:
        simple: 90 days ago
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 835
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 7aeb2930-cf52-48bc-8414-6aa5fb39cc3d
    type: regular
    task:
      id: 7aeb2930-cf52-48bc-8414-6aa5fb39cc3d
      version: -1
      name: Email Indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      tags:
        simple: FortiManager Vulnerability, CVE-2024-47575, FortiJump
      type:
        simple: Email
      value:
        simple: ${ExtractedIndicators.Email}
      verdict:
        simple: Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 492ead9e-256f-4fff-8762-9475fd141bea
    type: title
    task:
      id: 492ead9e-256f-4fff-8762-9475fd141bea
      version: -1
      name: Mitigations
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 314858a6-69de-4ac4-8686-084e6fafffa7
    type: regular
    task:
      id: 314858a6-69de-4ac4-8686-084e6fafffa7
      version: -1
      name: Recommended Mitigations and Workarounds
      description: |2+

        ## Official Workarounds

        According to the [Fortinet PSIRT Advisory FG-IR-24-423](https://www.fortiguard.com/psirt/FG-IR-24-423), the following workarounds are recommended to mitigate the risk associated with CVE-2024-47575:

        #### 1. Restrict Access to the FortiManager Interface

        Apply local-in policies on FortiManager versions 7.2.0 and above to whitelist the IP addresses of FortiGates that are allowed to connect.

          ```
        config system local-in-policy
        edit 1
        set action accept
        set dport 541
        set src <trusted_IPs>
        next
        edit 2
        set dport 541
        set action deny
        next
        end
        ```

        #### 2. Deny Unknown Devices - FortiManager versions 7.0.12 or above, 7.2.5 or above, 7.4.3 or above (but not 7.6.0).

        ```
        config system global
        (global)# set fgfm-deny-unknown enable
        (global)# end
        ```
        Warning: With this setting enabled, be aware that if a FortiGate's SN is not in the device list, FortiManager will prevent it from connecting to register upon being deployed, even when a model device with PSK is matching.

        #### 3. Custom Certificates - FortiManager versions 7.2.2 and above, 7.4.0 and above, 7.6.0 and above.

        ```
        config system global
        set fgfm-ca-cert
        set fgfm-cert-exclusive enable
        end
        ```
        And install that certificate on FortiGates. Only this CA will be valid, this can act as a workaround, providing the attacker cannot obtain a certificate signed by this CA via an alternate channel.

      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1495
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: dccebff4-50c0-4ace-82d3-ce860a805802
    type: title
    task:
      id: dccebff4-50c0-4ace-82d3-ce860a805802
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 349b8b51-9af2-41e1-81f6-326621c7b307
    type: condition
    task:
      id: 349b8b51-9af2-41e1-81f6-326621c7b307
      version: -1
      name: Suspicious activity detected?
      description: Check if results returned from the XQL queries
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEqualString
          left:
            value:
              simple: PaloAltoNetworksXQL.GenericQuery.number_of_results
            iscontext: true
          right:
            value:
              simple: "0"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: bf114df4-8aa2-43e8-80e9-c29c67f3dad0
    type: collection
    task:
      id: bf114df4-8aa2-43e8-80e9-c29c67f3dad0
      version: -1
      name: Threat Hunting findings acknowledgement
      description: Require the analyst to acknowledge results were found
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Did you review the suspicious activity detected?
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: "Yes"
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Analyst Acknowledgement
      description: Requires the analyst to acknowledge the findings
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "13_14_yes": 0.4
    },
    "paper": {
      "dimensions": {
        "height": 1685,
        "width": 1240,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: rawIoCs
  value:
    simple: 195.85.114[.]78, 104.238.141[.]143, 45.32.41[.]202, 158.247.199[.]37, CVE-2024-47575, 0qsc137p@justdefinition[.]com
  required: false
  description: FortiGuard Labs IoCs
  playbookInputQuery:
inputSections:
- inputs:
  - rawIoCs
  name: General (Inputs group)
  description: Generic group for inputs
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0