Security News > 2023 > February > Hackers now exploit critical Fortinet bug to backdoor servers
Threat actors are targeting Internet-exposed Fortinet appliances with exploits targeting CVE-2022-39952, an unauthenticated file path manipulation vulnerability in the FortiNAC webserver that can be abused for remote command execution.
These attacks come one day after Horizon3 security researchers released proof-of-concept exploit code for the critical-severity flaw that will add a cron job to initiate a reverse shell on compromised systems as the root user.
Fortinet disclosed the vulnerability in a security advisory on Thursday, saying the bug affects multiple versions of its FortiNAC network access control solution and allows attackers to execute unauthorized code or commands following successful exploitation.
Since Fortinet has not provided mitigation guidance or workarounds, updating is the only way to thwart attack attempts.
Malicious activity observed while analyzing these ongoing attacks matches Horizon3's PoC exploit capabilities, with CronUp seeing threat actors using corn jobs to open reverse shells to attackers' IP addresses.
In December, Fortinet warned customers to patch FortiOS SSL-VPN appliances against an actively exploited security bug that enables unauthenticated remote code execution on vulnerable devices.
- Hackers backdoor Microsoft IIS servers with new Frebniis malware (source)
- Exploit released for critical Fortinet RCE flaws, patch now (source)
- Exploit released for critical Fortinet RCE flaw, patch now (source)
- Chinese Hackers Exploit Fortinet Zero-Day Flaw for Cyber Espionage Attack (source)
- QNAP fixes critical bug letting hackers inject malicious code (source)
- Exploit released for critical VMware vRealize RCE vulnerability (source)
- North Korean Hackers Exploit Unpatched Zimbra Devices in 'No Pineapple' Campaign (source)
- Iranian OilRig Hackers Using New Backdoor to Exfiltrate Data from Govt. Organizations (source)
- GoAnywhere MFT zero-day vulnerability lets hackers breach servers (source)
- Hackers backdoor Windows devices in Sliver and BYOVD attacks (source)
|2023-02-16||CVE-2022-39952|| Externally Controlled Reference to a Resource in Another Sphere vulnerability in Fortinet Fortinac |
A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.
| 9.8 |