Security News > 2023 > February > Hackers now exploit critical Fortinet bug to backdoor servers

Threat actors are targeting Internet-exposed Fortinet appliances with exploits targeting CVE-2022-39952, an unauthenticated file path manipulation vulnerability in the FortiNAC webserver that can be abused for remote command execution.

These attacks come one day after Horizon3 security researchers released proof-of-concept exploit code for the critical-severity flaw that will add a cron job to initiate a reverse shell on compromised systems as the root user.

Fortinet disclosed the vulnerability in a security advisory on Thursday, saying the bug affects multiple versions of its FortiNAC network access control solution and allows attackers to execute unauthorized code or commands following successful exploitation.

Since Fortinet has not provided mitigation guidance or workarounds, updating is the only way to thwart attack attempts.

Malicious activity observed while analyzing these ongoing attacks matches Horizon3's PoC exploit capabilities, with CronUp seeing threat actors using corn jobs to open reverse shells to attackers' IP addresses.

In December, Fortinet warned customers to patch FortiOS SSL-VPN appliances against an actively exploited security bug that enables unauthenticated remote code execution on vulnerable devices.

News URL

https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-fortinet-bug-to-backdoor-servers/