Is my FortiGate SSL VPN a risk?

What is a FortiGate SSL VPN?

Note that customers who have not enabled SSL-VPN are not impacted by this vulnerability.

FortiGate is Fortinet's firewall, common in small offices. Its SSL VPN lets staff connect from home through a sign-in page on the internet.

Why does it matter?

Threat actors have compromised vulnerable devices and maintained persistence even after patches were applied, potentially accessing sensitive files including credentials and key material.

Canada's Cyber Centre says threat actors have compromised vulnerable devices and maintained persistence even after patches were applied, potentially reaching credentials and key material.

Note that customers who have not enabled SSL-VPN are not impacted by this vulnerability.

One of the flaws involved lets a remote attacker with no account run code through crafted web requests. CISA added it to its catalog of exploited flaws on 9 February 2024.

What do I do about it?

Fortinet FortiOS Out-of-Bound Write Vulnerability 2024-02-09 Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.

The Cyber Centre says to disable SSL-VPN if it is not required, limit access to trusted addresses, and turn off admin access on any internet-facing interface.

1. Install Fortinet's fixed FortiOS version.
2. Reset every password and key tied to the SSL VPN and the device.
3. Turn off the SSL VPN if nobody uses it.
4. Turn off admin access on the internet-facing side in the FortiGate settings.