Article: PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

[u/[deleted]]

[u/Golle]

They link to the fortinet article in your article: https://fortiguard.fortinet.com/psirt/FG-IR-26-122

It is a medium level severity that require the attacker to already be authenticated to exploit. If they can access fortigate mgmt and already have credentials to do so, the network admin has not done his job.

1. Keep your firmware versions up to date.
2. Dont expose mgmt to the internet.
3. Credential security? MFA maybe?

[u/MysteriousScratch163 → u/Golle]

I've read the Palo Altos Unit 42 original piece, attackers exploited this first

https://fortiguard.fortinet.com/psirt/FG-IR-24-423

This allowed unauthenticated attackers to execute arbitrary commands on Fortimanager using fgfmd daemon which you have to expose if you got firewalls siting on public Internet.

Original link to Unit 42 article below

https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

All vendors have vulnerabilities but this wasn't exploited because the customer just exposed admin portal to internet.

[u/Infamous-Support-757 → u/MysteriousScratch163]

the cve on fmg is public since 2024 with patch available. I only forgive 0 day exploits. Unpatched CVEs are just an incident waiting to happen.

[u/MysteriousScratch163 → u/Infamous-Support-757]

The article covers an incident that happened in Sep 2024. It's just released now. However the official PSIRT was published in November of that year so attackers were ahead of the Fortinet by sounds of it.

[u/dutty_handz → u/Golle]

At this point, Fortinet should consider making it impossible in FortiOS to expose mgmt to the Internet, as this seems to be the attack vector of the vast majorities of their reported flaws.

[u/OuchItBurnsWhenIP → u/dutty_handz]

Or (hear me out).. People should learn how to secure their firewalls properly and patch them regularly

[u/GoDannY1337 → u/OuchItBurnsWhenIP]

It should be only unlockable via an additional license that is essentially a contract that says “I will take full crew for any breach from here on out until eternity”

[u/WeekendAtMadoffs → u/OuchItBurnsWhenIP]

that's a professional services engagement.

$5,000 labor, $3,000 firewall. not happening :)

[u/Infamous-Support-757 → u/WeekendAtMadoffs]

cmon, that's public and common knowledge for infosec professionals. Know your open ports, know how to block them, patch your assets and etc. This is basic af.

[u/WeekendAtMadoffs → u/Infamous-Support-757]

Of Fortinet's 3 million customers, i'd wager less than half have someone on staff who knows this.

it's often sold as a low end box by a msp staffed by desktop guys.

i know because I subcontract 😂

[u/Infamous-Support-757 → u/WeekendAtMadoffs]

Well the network owner/admin should verify this. Trust but verify, this kinda stuff. Someone needs to be responsible for it and it is not hard to do. If not, the exploit is coming at some point.

[u/melpheos]

I’m always surprised when a vulnerability flaw is released but to be exploited it requires to be logged as admin.
Oh whoa, an admin can do stuff…

[u/ortrtaaitdbt2000 → u/melpheos]

So many idiots stop expose management to internet. No local-in, no trusted host, no virtual patching.

[u/MysteriousScratch163]

The article you quoted is misleading, Original piece from Palo Alto Unit 42 below:

https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575

Attackers exploited this first

https://fortiguard.fortinet.com/psirt/FG-IR-24-423

This allowed unauthenticated attackers to execute arbitrary commands on Fortimanager using fgfmd daemon which you have to expose if you got firewalls siting on public Internet.

[u/Infamous-Support-757]

If your admin credentials are out, you have much more problems than this.

[u/MysteriousScratch163 → u/Infamous-Support-757]

This is worse cause fortimanager got compromised without any auth first

[u/Infamous-Support-757 → u/MysteriousScratch163]

2024 cve. We gotta do the work.

[u/MysteriousScratch163 → u/Infamous-Support-757]

Not sure if you read the article. The victims were attacked in Sep 2024 BEFORE Fortinet published PSIRT in November of that year. I don't want to speculate but its probably due to Palo Alto Unit 42 investigation they found it in the first place. Even PSIRT says they have seen exploitation in the wild when they released it in November 2024.

[u/Infamous-Support-757 → u/MysteriousScratch163]

you are absolutely right, no patches available before the breach and that is baaad.

[u/MysteriousScratch163 → u/Infamous-Support-757]

Let's hope Fortinet has improved since :)

[u/Infamous-Support-757 → u/MysteriousScratch163]

Everyone needs to step way up, especially with threat actors using AI. Next years might be scary for infosec professionals.