InfoSec HitchensMar 22, 2024
https://medium.com/@infosechitch/zero-day-siege-the-fortinet-flaw-exposing-the-underbelly-of-corporate-defenses-e435b60792f2?source=-----e435b60792f2----0----------------------------
Zero-Day Siege: The Fortinet Flaw Exposing the Underbelly of Corporate Defenses

In a rather dramatic turn that might stir the pot more than a tempest in a teapot, the cyber sleuths have once again unearthed a vulnerability so potent that it threatens the sanctity of Fortinet’s…

Medium
Show threadhal8999Mar 22, 2024

@InfosecHitchens No mention if Fortigate IDP on the inbound connection to a public-facing FortiClientEMS would stop the attack vector.

Or, what about the cloud-service for FortiClientEMS Cloud found at forticlient.forticloud[.]com/ems

Each customer should be an isolated instance. What does root get an attacker? A Windows box? A nerfed Linux VM? Nothing?

I think these instances must be upgraded by Fortinet in a maintenance window. A customer cannot un-publish the service from the internet.

Show threadInfoSec HitchensMar 22, 2024
@hal8999 Good feedback, I shall make some adjustments to my original post.
Show threadInfoSec HitchensMar 22, 2024
@hal8999 Your response was added to the original article and further clarification given, thank you for the valuable insight.
Show threadhal8999

@InfosecHitchens I think you misunderstood. The cloud-based EMS is always published to the public internet. A customer cannot block access or un-publish it because they don't have control.

If you had on-prem Exchange, you could block internet access by a firewall rule until you patched. Or, filter inbound traffic through IDP and application filters.

With 'cloud', the customer no longer controls the firewall or the server on the back-end. So, their environment is always left exposed to the internet unless/until the provider patches the environment or performs some other sort of action to block access.

Mar 22, 2024 at 11:14pmWeb
Show threadInfoSec HitchensMar 22, 2024
@hal8999 Thank you, I shall make another edit.
Show threadInfoSec HitchensMar 23, 2024
@hal8999 Thanks once more, I have made another edit to the article with your clarification and also added in additional details about how it could be exploited from the writeup done by @horizon3attack