{"id":7518,"date":"2021-07-14T20:02:49","date_gmt":"2021-07-15T03:02:49","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7518"},"modified":"2023-04-05T12:39:00","modified_gmt":"2023-04-05T19:39:00","slug":"new-threat-group-agrius-exploits-old-fortinet-vpn-vulnerabilities","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/new-threat-group-agrius-exploits-old-fortinet-vpn-vulnerabilities\/","title":{"rendered":"New Threat Group Agrius Exploits Old Fortinet VPN Vulnerabilities"},"content":{"rendered":"
\n

{Updated September 2021}:<\/strong> On September 8, 2021, a new Russian-speaking threat actor was identified actively exploiting the Fortinet VPN vulnerability, CVE-2018-13379. The threat actor called Orange<\/a> is the administrator of the new RAMP hacking forum and was previously the operator of the Babuk Ransomware operation. They stole data from unpatched servers and put them up on a Groove Ransomware site. The perpetrator\u2019s breach list<\/a> reportedly contains the login credentials to multiple top organizations in 74 countries, including India, France, Israel, Italy, Taiwan, and the USA.<\/p>\n

CVE-2018-13379 has been one of the most widely exploited vulnerabilities of 2020 and was called out by CSW researchers in the Ransomware Q2 report 2021<\/a>.<\/p>\n

We urge our readers and clients to patch their Fortinet VPN servers without further delay to stave off a major ransomware attack.<\/strong><\/p>\n<\/blockquote>\n

{Updated on August 18, 2021}: <\/strong>On 17 August 2021, researchers intimated Fortinet after discovering a zero-day command injection vulnerability, a variant of CVE-2021-22123<\/a>, in the FortiWeb Web Application Firewall (WAF).<\/p>\n

This high severity vulnerability, which still does not have a CVE number, is likely to be classified under the weakness enumeration CWE-78 (Improper Neutralization of Special Elements used in an OS Command (\u2018OS Command Injection\u2019) with a CVSS v3 score of 8.8. The zero-day flaw allows authenticated attackers to execute arbitrary commands with root privileges on an underlying system via a SAML server configuration page.<\/p>\n

The vulnerability can also be chained with another authentication bypass flaw, CVE-2020-29015<\/a>, giving an attacker full control of all vulnerable servers.<\/p>\n

The zero-day vulnerability impacts FortiWeb versions 6.3.11 and prior. A patch for the vulnerability is expected to be released with the version 6.4.1 upgrade coming up at the end August.<\/p>\n

We urge organizations to keep themselves up-to-date about the latest patches and security upgrades to avoid any untoward events.<\/p>\n

 <\/p>\n

\n

In a latest update on 19 July 2021, Fortinet released an advisory<\/a>\u00a0to all its clients, sharing patch details and workarounds for a Use-After-Free vulnerability, classified under CWE-416, in FortiManager and FortiAnalyzer. Our research analyzed the vulnerability may lead to remote code execution after unauthorized access to root. Our analysis of the vulnerability is detailed below.<\/strong><\/p>\n<\/blockquote>\n

Three Virtual Private Network (VPN) vulnerabilities in FortiOS that have existed for over a year now have recently been exploited in an attack against a local US municipal government<\/a>. The newly discovered threat group, Agrius, has been observed using a\u00a0relatively new ransomware called Apostle to exploit these vulnerabilities.\u00a0<\/strong><\/p>\n

CSW warned of the Fortinet VPN vulnerabilities<\/strong><\/h2>\n

The possibility of a VPN vulnerability being exploited was called out by CyberSecurityWorks one year ago in a report<\/a> published in July 2020, enumerating three possible vulnerabilities, which were already weaponized.<\/p><\/blockquote>\n

<\/b><\/p>\n

Further, in an article published in December 2020, titled \u2018Fortinet\u2019s 50,000 VPN Leak Highlights Lack of Cyber Hygiene<\/a>\u2019, our analysis pointed out a critical vulnerability, CVE-2018-13379, in the restricted directory titled \u2018Path Traversal\u2019 in Fortinet VPN versions 5.4.6 to 6.0.4, putting close to 50,000 IP addresses at risk.<\/p>\n

<\/b><\/p>\n

Fortinet Vulnerabilities<\/strong><\/h2>\n

FortiManager & FortiAnalyzer:<\/strong><\/p>\n

CVE-2021-32589<\/strong><\/p>\n