CVE-2022-40684: 
FortiOS vulnerability analysis and mitigation

CVE-2022-40684 is a critical authentication bypass vulnerability affecting Fortinet FortiOS versions 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6, and FortiSwitchManager version 7.2.0 and 7.0.0. The vulnerability was discovered in September 2022 and publicly disclosed on October 10, 2022. This vulnerability allows an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests (CVE Mitre, Fortinet Blog).

The vulnerability is an authentication bypass using an alternate path or channel (CWE-288) that exists in the administrative interface. The exploit leverages the Forwarded header to set the client_ip to "127.0.0.1" and requires the User-Agent to be set to "Report Runner" or "Node.js". The vulnerability has been assigned a CVSS score of 9.6 (Critical) (Horizon3 Research, Fortiguard).

The vulnerability allows attackers to perform unauthorized operations on the administrative interface, including changing network configurations, adding new users, and initiating packet captures. Attackers can potentially gain full administrative access to the affected systems, allowing them to modify system configurations and potentially compromise the entire network infrastructure (Horizon3 Research).

Fortinet has released patches to address this vulnerability and strongly recommends immediate updates to the latest versions of the affected products. Organizations should validate their configurations to ensure no unauthorized changes have been implemented by malicious third parties, regardless of whether they have upgraded. Fortinet provided early confidential notification to customers to enable remediation before the vulnerability became public (Fortinet Blog).

Fortinet took a proactive approach by providing early confidential notifications to customers on October 6, 2022, before the public disclosure. The company worked with CISA and other agencies to ensure broad communication of the vulnerability. Despite multiple notifications, Fortinet noted that a significant number of devices still required mitigation after the initial disclosure (Fortinet Blog).