A world of hurt for Fortinet and ManageEngine after users fail to install patches

Organizations around the world are once again learning the risks of not installing security updates as multiple threat actors race to exploit two recently patched vulnerabilities that allow them to infect some of the most critical parts of a protected network.

The vulnerabilities both carry severity ratings of 9.8 out of a possible 10 and reside in two unrelated products crucial in securing large networks. The first, tracked as CVE-2022-47966, is a pre-authentication remote code execution vulnerability in 24 separate products from ManageEngine, a division of Zoho. It was patched in waves from last October through November. The second vulnerability, CVE-2022-39952, affects a product called FortiNAC, made by cybersecurity company Fortinet, and was patched last week.

Some ManageEngine products and FortiNAC are billed as pilars of zero-trust, meaning they operate under the assumption a network has been breached and constantly monitor devices to ensure they're not infected or acting maliciously. Zero-trust products don't trust any network devices or nodes on a network and instead actively work to verify they're safe.

24 ManageEngine products affected

ManageEngine is the motor that powers a wide range of network management software and appliances that perform core functions. AD Manager Plus, for instance, helps admins set up and maintain the Active Directory, the Windows service for creating and deleting all user accounts on a network and delegating system privileges to each one. Password Manager Pro provides a centralized digital vault for storing all of a network's password data. Other products enabled by ManageEngine manage desktops, mobile devices, servers, applications, and service desks.

CVE-2022-47966 allows attackers to remotely execute malicious code by issuing a standard HTTP POST request that contains a specially crafted response using the Security Assertion Markup Language. (SAML, as it's abbreviated, is an open-standard language identity providers and service providers use to exchange authentication and authorization data.) The vulnerability stems from ManageEngine's use of an outdated version of Apache Santuario for XML signature validation.

In January, roughly two months after ManageEngine patched the vulnerability, security firm Horizon3.ai published a deep dive analysis that included proof-of-concept exploit code. Within a day, security firms such as Bitdefender began seeing a cluster of active attacks from multiple threat actors targeting organizations worldwide that still hadn't installed the security update.

Some attacks exploited the vulnerability to install tools such as the command line Netcat and, from there, the Anydesk remote login software. When successful, the threat actors sell the initial access to other threat groups. Other attack groups exploited the vulnerability to install ransomware known as Buhti, post-exploitation tools such as Cobalt Strike and RAT-el, and malware used for espionage.

"This vulnerability is another clear reminder of the importance of keeping systems up to date with the latest security patches while also employing strong perimeter defense," Bitdefender researchers wrote. "Attackers don't need to scour for new exploits or novel techniques when they know that many organizations are vulnerable to older exploits due, in part, to the lack of proper patch management and risk management."

ManageEngine representatives wrote in a statement:

The cited CVE-2022-47966 refers to a patched vulnerability that affected multiple ManageEngine branded on-premises (locally installable) software products. We released patches for individual products during October-November 2022. A public advisory was also issued late last year, encouraging our customers to patch their installations immediately. Please refer to this link for the same. Furthermore, we have taken steps to incorporate additional security controls and measures wherever required to prevent similar vulnerabilities in the future. Please be informed that this vulnerability (CVE-2022-47966) doesn't pertain to Zoho-branded products, but only ManageEngine products.

FortiNAC under "massive" attack

CVE-2022-39952, meanwhile, resides in FortiNAC, a network access control solution that identifies and monitors every device connected to a network. Large organizations use FortiNAC to protect operational technology networks in industrial control systems, IT appliances, and Internet of Things devices. The vulnerability class, known as an external control of file name or path, allows unauthenticated attackers to write arbitrary files to a system and, from there, obtain remote code execution that runs with unfettered root privileges.

Fortinet patched the vulnerability on February 16 and within days, researchers from multiple organizations reported it was under active exploit. The warnings came from organizations or companies, including Shadowserver, Cronup, and Greynoise. Once again, Horizon3.ai provided a deep dive that analyzed the cause of the vulnerability and how it could be weaponized.

"We have started to detect the massive installation of Webshells (backdoors) for later access to compromised devices," researchers from Cronup wrote.

The vulnerability is being exploited by what appear to be multiple threat actors in attempts to install different web shells, which provide attackers with a text window through which they can remotely issue commands.

In a blog post published Thursday, Fortinet CTO Carl Windsor said the company regularly performs internal security audits to find security bugs in its products.

"Importantly, it was during one of these internal audits that the Fortinet PSIRT team itself identified this Remote Code Execution vulnerability," Windsor wrote. "We immediately remediated and published this finding as part of our February PSIRT advisory. (If you are not subscribed to our advisories, we highly recommend registering using one of the methods described here.) Fortinet PSIRT policy balances our culture of transparency with our commitment to the security of our customers."

Further Reading

Further Reading

The attacks in recent years show that security products designed to keep attackers out of protected networks can be a double-edged sword that can be particularly dangerous when companies fail to disclose them or, more recently, customers fail to install updates. Anyone who administers or oversees networks that use either ManageEngine or FortiNAC should check immediately to see if they're vulnerable. The above-linked research posts provide a wealth of indicators people can use to determine if they've been targeted.