id: CVE-2024-47575 - FortiManager Authentication Bypass version: -1 name: CVE-2024-47575 - FortiManager Authentication Bypass description: "CVE-2024-47575, also known as **FortiJump**, is a critical zero-day vulnerability affecting **FortiManager**, a centralized management platform for Fortinet devices. The vulnerability arises due to missing authentication checks in specific FortiManager REST API endpoints. An unauthenticated attacker with network access to the FortiManager device can exploit this flaw to execute arbitrary code or commands, potentially leading to complete system compromise.\n\n---\n\n## Affected Versions\n\n| FortiManager Version | Status |\n|------------------------|--------------------|\n| **7.2.0 to 7.2.3** | Affected |\n| **7.0.0 to 7.0.7** | Affected |\n| **6.4.0 to 6.4.11** | Affected |\n| **6.2.x and earlier** | Potentially Affected |\n| **7.2.4 and above** | **Patched** |\n| **7.0.8 and above** | **Patched** |\n| **6.4.12 and above** | **Patched** |\n\n*Note:*\n\nOld FortiAnalyzer models 1000E, 1000F, 2000E, 3000E, 3000F, 3000G, 3500E, 3500F, 3500G, 3700F, 3700G, 3900E with the following feature enabled (FortiManager on FortiAnalyzer):\n\nconfig system global\nset fmg-status enable\nend\n\nAnd at least one interface with the fgfm service enabled is also impacted by this vulnerability.\n\n---\n\n## Playbook Flow\n\n1. Create, Tag, and Block Indicators\n\n2. Hunt **Automatically** for Suspicious Behavior Related to the exploitation flow using XQL\n**Note: The 'fortinet_fortimanager_raw' dataset must be available for the XQL queries completion.**\n\n3. Provide Mitigations and Workarounds\n\n---\n\n**References**:\n\n- [Fortinet PSIRT Advisory FG-IR-24-423](https://www.fortiguard.com/psirt/FG-IR-24-423)\n\n---\n\nBy following this playbook, organizations can effectively respond to and mitigate the risks associated with **CVE-2024-47575 (FortiJump)**. \n" tags: - FortiJump - CVE-2024-47575 - FortiManager Vulnerability starttaskid: "0" tasks: "0": id: "0" taskid: e638d977-c697-44e9-8caf-9711598be275 type: start task: id: e638d977-c697-44e9-8caf-9711598be275 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: 3e555db3-5358-4a2c-8541-3977d0dfa466 type: regular task: id: 3e555db3-5358-4a2c-8541-3977d0dfa466 version: -1 name: Extract indicators from hardcoded input description: commands.local.cmd.extract.indicators script: Builtin|||extractIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "2" scriptarguments: text: simple: ${inputs.rawIoCs} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 195 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 23a45588-c954-4d0c-8f0b-61d032408181 type: title task: id: 23a45588-c954-4d0c-8f0b-61d032408181 version: -1 name: Create and Tag Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "3" - "4" - "9" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: be1ec492-d8f8-40cb-804b-c31e573a9f4f type: regular task: id: be1ec492-d8f8-40cb-804b-c31e573a9f4f version: -1 name: IP Indicators description: commands.local.cmd.new.indicator script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "6" scriptarguments: tags: simple: FortiManager Vulnerability, CVE-2024-47575, FortiJump type: simple: IP value: simple: ${ExtractedIndicators.IP} verdict: simple: Malicious separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 515 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: cbce2eae-896c-4e8c-894b-a4ffd3d34e4e type: regular task: id: cbce2eae-896c-4e8c-894b-a4ffd3d34e4e version: -1 name: CVE Indicators description: commands.local.cmd.new.indicator script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "6" scriptarguments: tags: simple: FortiManager Vulnerability, CVE-2024-47575, FortiJump type: simple: CVE value: simple: ${ExtractedIndicators.CVE} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 910, "y": 515 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 8ab19925-9fbe-4fcd-8b82-a156cf3753d7 type: title task: id: 8ab19925-9fbe-4fcd-8b82-a156cf3753d7 version: -1 name: XQL Hunting Queries type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" - "8" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 7391477e-4356-4c10-8351-431248a5a355 type: regular task: id: 7391477e-4356-4c10-8351-431248a5a355 version: -1 name: Unusual configuration changes description: |- Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context. script: '|||xdr-xql-generic-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "13" scriptarguments: query: simple: "config case_sensitive = false \n| dataset = fortinet_fortimanager_raw \n| filter _raw_log in (\"*Add device*\",\"*Modify device*\")\n| alter elog_changes = regextract(_raw_log, \"changes=\\\"(.*)\\\"\")\n| alter elog_msg = regextract(_raw_log, \"msg=\\\"(.*)\\\"\")" query_name: simple: FortiManager_CVE-2024-47575_Unusual_Configuration_Changes time_frame: simple: 90 days ago separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 265, "y": 835 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 3972d968-ea7a-4ef4-8b39-ca3ca0695684 type: regular task: id: 3972d968-ea7a-4ef4-8b39-ca3ca0695684 version: -1 name: Known IOCs and post-exploitation artifacts description: |- Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context. script: '|||xdr-xql-generic-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "13" scriptarguments: query: simple: "config case_sensitive = false \n| dataset = fortinet_fortimanager_raw \n| filter _raw_log in (\"*tmp/\",\"*45.32.41.202*\",\"*104.238.141.143*\",\"*158.247.199.37*\",\"*195.85.114.78*\",\"*VMTM23017412*\",\"*Unregistered device localhost add succeeded*\",\"*0qsc137p@justdefinition.com*\",\"*Purity Supreme*\")\n| alter elog_changes = regextract(_raw_log, \"changes=\\\"(.*)\\\"\")\n| alter elog_msg = regextract(_raw_log, \"msg=\\\"(.*)\\\"\")" query_name: simple: FortiManager_CVE-2024-47575_Known_IoCs time_frame: simple: 90 days ago separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 695, "y": 835 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 7aeb2930-cf52-48bc-8414-6aa5fb39cc3d type: regular task: id: 7aeb2930-cf52-48bc-8414-6aa5fb39cc3d version: -1 name: Email Indicators description: commands.local.cmd.new.indicator script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "6" scriptarguments: tags: simple: FortiManager Vulnerability, CVE-2024-47575, FortiJump type: simple: Email value: simple: ${ExtractedIndicators.Email} verdict: simple: Malicious separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 515 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 492ead9e-256f-4fff-8762-9475fd141bea type: title task: id: 492ead9e-256f-4fff-8762-9475fd141bea version: -1 name: Mitigations type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "11" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 1350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 314858a6-69de-4ac4-8686-084e6fafffa7 type: regular task: id: 314858a6-69de-4ac4-8686-084e6fafffa7 version: -1 name: Recommended Mitigations and Workarounds description: |2+ ## Official Workarounds According to the [Fortinet PSIRT Advisory FG-IR-24-423](https://www.fortiguard.com/psirt/FG-IR-24-423), the following workarounds are recommended to mitigate the risk associated with CVE-2024-47575: #### 1. Restrict Access to the FortiManager Interface Apply local-in policies on FortiManager versions 7.2.0 and above to whitelist the IP addresses of FortiGates that are allowed to connect. ``` config system local-in-policy edit 1 set action accept set dport 541 set src next edit 2 set dport 541 set action deny next end ``` #### 2. Deny Unknown Devices - FortiManager versions 7.0.12 or above, 7.2.5 or above, 7.4.3 or above (but not 7.6.0). ``` config system global (global)# set fgfm-deny-unknown enable (global)# end ``` Warning: With this setting enabled, be aware that if a FortiGate's SN is not in the device list, FortiManager will prevent it from connecting to register upon being deployed, even when a model device with PSK is matching. #### 3. Custom Certificates - FortiManager versions 7.2.2 and above, 7.4.0 and above, 7.6.0 and above. ``` config system global set fgfm-ca-cert set fgfm-cert-exclusive enable end ``` And install that certificate on FortiGates. Only this CA will be valid, this can act as a workaround, providing the attacker cannot obtain a certificate signed by this CA via an alternate channel. type: regular iscommand: false brand: "" nexttasks: '#none#': - "12" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 1495 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: dccebff4-50c0-4ace-82d3-ce860a805802 type: title task: id: dccebff4-50c0-4ace-82d3-ce860a805802 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 1670 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 349b8b51-9af2-41e1-81f6-326621c7b307 type: condition task: id: 349b8b51-9af2-41e1-81f6-326621c7b307 version: -1 name: Suspicious activity detected? description: Check if results returned from the XQL queries type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "14" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEqualString left: value: simple: PaloAltoNetworksXQL.GenericQuery.number_of_results iscontext: true right: value: simple: "0" continueonerrortype: "" view: |- { "position": { "x": 480, "y": 1010 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: bf114df4-8aa2-43e8-80e9-c29c67f3dad0 type: collection task: id: bf114df4-8aa2-43e8-80e9-c29c67f3dad0 version: -1 name: Threat Hunting findings acknowledgement description: Require the analyst to acknowledge results were found type: collection iscommand: false brand: "" nexttasks: '#none#': - "10" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 1190 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Did you review the suspicious activity detected? required: true gridcolumns: [] defaultrows: [] type: singleSelect options: [] optionsarg: - simple: "Yes" - simple: "No" fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Analyst Acknowledgement description: Requires the analyst to acknowledge the findings sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "13_14_yes": 0.4 }, "paper": { "dimensions": { "height": 1685, "width": 1240, "x": 50, "y": 50 } } } inputs: - key: rawIoCs value: simple: 195.85.114[.]78, 104.238.141[.]143, 45.32.41[.]202, 158.247.199[.]37, CVE-2024-47575, 0qsc137p@justdefinition[.]com required: false description: FortiGuard Labs IoCs playbookInputQuery: inputSections: - inputs: - rawIoCs name: General (Inputs group) description: Generic group for inputs outputSections: - outputs: [] name: General (Outputs group) description: Generic group for outputs outputs: [] tests: - No tests (auto formatted) fromversion: 6.10.0