[Update] Vulnerability in Fortinet FortiOS (February 9, 2024)

CERT-FR Alert Bulletin Subject: [Update] Vulnerability in Fortinet FortiOS Document Management A detailed version history is available at the end of this document. Risk - Remote arbitrary code execution Affected Systems - FortiOS 6.0 all versions - FortiOS versions 6.2.x prior to 6.2.16 - FortiOS versions 6.4.x prior to 6.4.15 - FortiOS versions 7.0.x prior to 7.0.14 - FortiOS versions 7.2.x prior to 7.2.7 - FortiOS versions 7.4.x prior to 7.4.3 - FortiProxy 1.0 all versions - FortiProxy 1.1 all versions - FortiProxy 1.2 all versions - FortiProxy versions 2.0.x prior to 2.0.14 - FortiProxy versions 7.0.x prior to 7.0.15 - FortiProxy versions 7.2.x prior to 7.2.9 - FortiProxy versions 7.4.x prior to 7.4.3 [Update of February 15, 2024] Addition of FortiProxy and new versions in affected systems following the update to the vendor bulletin of February 8, 2024. Summary [Update of March 19, 2024] CERT-FR is aware of public exploit code and new exploitation attempts. On February 8, 2024, Fortinet published a security advisory regarding the critical vulnerability CVE-2024-21762 affecting the FortiOS SSL VPN. This vulnerability allows an unauthenticated attacker to cause remote arbitrary code execution. [Update of February 15, 2024] An update to the February 8 bulletin indicates that FortiProxy is also affected by this vulnerability. CISA is aware of exploitation of this vulnerability by attackers [1]. CERT-FR therefore strongly recommends applying the patch as soon as possible. Temporary Workaround The vendor recommends disabling SSL VPN if patching is not possible. Fortinet notes that disabling the web interface is not sufficient. Solution Refer to the vendor's security bulletin for patches (see Documentation section). Documentation - Fortinet Security Bulletin FG-IR-24-015 of February 8, 2024 https://www.fortiguard.com/psirt/FG-IR-24-015 - [1] CISA Known Exploited Vulnerabilities Catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog - CERT-FR Advisory CERTFR-2024-AVI-0108 of December 9, 2023 /avis/CERTFR-2024-AVI-0108/ - CVE Reference CVE-2024-21762 https://www.cve.org/CVERecord?id=CVE-2024-21762