Fortinet warns of auth bypass zero-day exploited to hijack firewalls

Attackers are exploiting a new authentication bypass zero-day vulnerability in FortiOS and FortiProxy to hijack Fortinet firewalls and breach enterprise networks. This security flaw (tracked as CVE-2024-55591) impacts FortiOS 7.0.0 through 7.0.16, FortiProxy 7.0.0 through 7.0.19, and FortiProxy 7.2.0 through 7.2.12. Successful exploitation allows remote attackers to gain super-admin privileges by making malicious requests to the Node.js websocket module. Fortinet says attackers exploiting the zero-day in the wild are creating randomly generated admin or local users on compromised devices and are adding them to existing SSL VPN user groups or to new ones they also add. They've also been observed adding or changing firewall policies and other settings and logging in to SSLVPN using previously created rogue accounts "to get a tunnel to the internal network." While the company didn't provide additional information on the campaign, cybersecurity company Arctic Wolf released a report on Friday with matching indicators of compromise (IOCs), which says that Fortinet FortiGate firewalls with Internet-exposed management interfaces have been under attack since mid-November. "The campaign involved unauthorized administrative logins on management interfaces of firewalls, creation of new accounts, SSL VPN authentication through those accounts, and various other configuration changes," Arctic Wolf Labs said. "While the initial access vector is not definitively confirmed, a zero-day vulnera...