https://github.com/chocapikk/cve-2022-40684
Fortinet Critical Authentication Bypass Vulnerability (CVE-2022-40684) [ Mass Exploit ]
https://github.com/chocapikk/cve-2022-40684
Last synced: 9 months ago
JSON representation
Fortinet Critical Authentication Bypass Vulnerability (CVE-2022-40684) [ Mass Exploit ]
- Host: GitHub
- URL: https://github.com/chocapikk/cve-2022-40684
- Owner: Chocapikk
- Created: 2022-10-15T16:51:25.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2022-10-19T16:27:16.000Z (over 3 years ago)
- Last Synced: 2024-12-12T07:10:04.172Z (over 1 year ago)
- Language: Python
- Size: 13.7 KB
- Stars: 5
- Watchers: 2
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# CVE-2022-40684 (CVSS score: 9.6)
POC for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager appliances.
## Vulnerable Products
- FortiOS versions between 7.0.0 – 7.0.6 and 7.2.0 – 7.2.1
- FortiProxy versions between 7.0.0 – 7.0.6 and version 7.2.0
- FortiSwitchManager versions 7.0.0 and 7.2.0
## Resource
https://socradar.io/what-do-you-need-to-know-about-fortinet-critical-authentication-bypass-vulnerability-cve-2022-40684/
## Summary
This POC abuses the authentication bypass vulnerability to set an SSH key for the specified user.
## Usage
```plaintext
root@kali:~# python exploit.py -h
______ __ _ __ ____ ____________
/ ____/___ _____/ /_(_)___ ___ / /_ / __ \/ ____/ ____/
/ /_ / __ \/ ___/ __/ / __ \/ _ \/ __/ / /_/ / / / __/
/ __/ / /_/ / / / /_/ / / / / __/ /_ / _, _/ /___/ /___
/_/ \____/_/ \__/_/_/ /_/\___/\__/ /_/ |_|\____/_____/
CVE-2022-40684 Exploit By Valentin Lobstein (Chocapikk)
usage: exploit.py [-h] [-k KEY] [-u URL] [-l LIST] [-U USERNAME] [-t THREADS] [-o OUTPUT]
options:
-h, --help show this help message and exit
-k KEY, --key KEY Your SSH pubKey id_rsa.pub
-u URL, --url URL Base target uri (ex. http://target-uri/)
-l LIST, --list LIST List of targets (list.txt)
-U USERNAME, --username USERNAME
Username
-t THREADS, --threads THREADS
Threads
-o OUTPUT, --output OUTPUT
Output file
```
## Zoomeye Dork
```plaintext
title:"FortiGate"
```
## Mitigations
Update to the latest version or mitigate by following the instructions within the Fortinet PSIRT
* https://www.fortiguard.com/psirt/FG-IR-22-377
## Disclaimer
This software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.