Description

CVE-2024-40591 describes an incorrect privilege assignment vulnerability in Fortinet FortiOS. Specifically, an authenticated administrator with Security Fabric permissions can escalate their privileges to super-admin. This is achieved by connecting the vulnerable FortiGate device to a malicious upstream FortiGate controlled by the attacker. This vulnerability affects FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9, and before 7.0.15. Although the CVSS score is 8.8 (High), the SVRS score is 0, indicating that, based on the vulnerability intelligence gathered by SOCRadar from sources like social media, news, code repositories, the dark/deep web, and associations with threat actors, the real-world risk and urgency are currently low.

Key Insights

1. Privilege Escalation: The core issue is a privilege escalation vulnerability. An attacker with limited admin access (Security Fabric permissions) can gain complete control (super-admin) over the FortiGate device.

2. Malicious Upstream FortiGate Requirement: The exploitation of this vulnerability requires the attacker to control a malicious upstream FortiGate. This adds a layer of complexity to the attack, but it's still a significant risk if the attacker can position such a device within the network.

3. Affected Versions: Multiple FortiOS versions are affected, increasing the potential attack surface. Organizations need to identify and patch vulnerable FortiGate devices across their infrastructure.

4. Low SVRS Score: The low SVRS score suggests that there is currently no active exploit. This can change quickly, underscoring the need to still remain vigilant.

Mitigation Strategies

1. Upgrade FortiOS: The primary mitigation is to upgrade FortiOS to a version that is not affected by CVE-2024-40591. Ensure proper testing is conducted in a lab environment before applying updates to production systems. Fortinet will release a patch so keeping an eye on security advisories is crucial.

2. Network Segmentation: Implement network segmentation to limit the blast radius of a compromised FortiGate device. This can prevent lateral movement and reduce the impact of a successful privilege escalation. This would reduce the attacker's ability to set up the "malicious upstream FortiGate" that the attack requires.

3. Monitor Security Fabric Connections: Closely monitor Security Fabric connections for any unusual activity. This can help detect and respond to an attacker attempting to exploit this vulnerability.

4. Review Administrator Access: Regularly review administrator access profiles and permissions to ensure that users only have the necessary privileges. Follow the principle of least privilege.

Additional Information

Although the SVRS score is currently low, it is critical to continually monitor for changes in exploit activity, threat actor interest, and new information related to CVE-2024-40591. If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.