Allegedly, many admins did not update their FortiGate VPNs, so that attackers attack systems. The reason is the exploit code for the vulnerability (CVE-2018-13379) from 2019 that has now emerged.

Successful attacks on the SSL-VPN configured FortiOS should be made possible by sending prepared HTTP requests. Attackers could access system files and thus gain access to unencrypted access data, for example. They could then log into vulnerable VPN firewalls and compromise them.

FortiOS, which is used on FortiGate firewalls, has a total of six security holes in several versions of the Security Network operating system that affect the SSL-VPN web portal. Fortinet has published the FortiGuard Security Advisories with update notes.

FortiGuard PSIRT Advisory

Der original Textauszug:

FortiOS system file leak through SSL VPN via specially crafted HTTP resource requests

Summary

A path traversal vulnerability in the FortiOS SSL VPN web portal may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
Impact

Information Disclosure
Affected Products
FortiOS 6.0 – 6.0.0 to 6.0.4
FortiOS 5.6 – 5.6.3 to 5.6.7
FortiOS 5.4 – 5.4.6 to 5.4.12
(other branches and versions than above are not impacted)
ONLY if the SSL VPN service (web-mode or tunnel-mode) is enabled.
Solutions

Upgrade to FortiOS 5.4.13, 5.6.8, 6.0.5 or 6.2.0 and above.

Workarounds:

As a temporary solution, the only workaround is to totally disable the SSL-VPN service (both web-mode and tunnel-mode) by applying the following CLI commands:

config vpn ssl settings
unset source-interface
end

Note that firewall policies tied to SSL VPN will need to be unset first for the above sequence to execute successfully.

As an example, when source-interface is „port1“ and SSL VPN interface is „ssl.root“, the following CLI commands would be needed to ensure „unset source-interface“ executes successfully:

config vpn ssl settings
config authentication-rule
purge (purge all authentication-rules)
end
end

config firewall policy
delete [policy-id] (SSL VPN policy ID(s) that srcintf is „ssl.root“ and dstintf is „port1“)
end

Note that code to exploit this vulnerability in order to obtain the credentials of logged in SSL VPN users was disclosed. In absence of upgrading to the versions listed above, mitigating the impact of this exploit can be done by enabling two-factor authentication for SSL VPN users. An attacker would then not be able to use stolen credentials to impersonate SSL VPN users.

<IfDefine IgnoreLines>
<VirtualHost *:80>
        ServerAdmin hostmaster@foo.com
        ServerName foo.com
        ServerAlias www.foo.com
        DocumentRoot /home/www/foo.com/web/html
        ErrorLog /var/www/foo.com/web/logs/error_log
        CustomLog /var/www/foo.com/web/logs/access_log common
        Options ExecCgi IncludesNOEXEC

 <Directory "/var/www/foo.com/web/html">
    AllowOverride ALL
    Options FollowSymLinks
    Require all granted
 </Directory>
</VirtualHost>
</IfDefine>

Die VirtualHost-Direktive wird ignoriert, da IgnoreLines ein erfundener Parameter ist, der niemals auf true getestet wird. Wenn man die VirtualHost-Direktive wieder ausführen möchte, entfernt man einfach IfDefine wieder.

Apache VirtualHost bei RHEL

Um zu verifiziren welche VirtualHost ausgeführt werden, führt man bei RHEL und CentOS das httpd control command aus.

$ httpd -S

Apache VirtualHost bei Debian/Ubuntu

Bei Debian und Ubuntu gibt es das apachectl server control command.

$ apachectl -S

Bei einigen ist es der Befehl apache2ctl, häufig auch liegen beide vor.

$ apache2ctl -S

Fazit

In diesem Beitrag wird beschrieben, wie Apache Konfigurationsdateien mehrzeilig als Kommentarblöcke auskommentiert und editiert werden können. Dort wo mehrere Zeilen als zusammenhängende Kommentarblöcke kommentiert werden sollen, um beispielsweise eine VirtualHost-Konfiguration vorübergehend zu deaktivieren. Es bietet sich hierzu die nicht vorhandene Laufzeitvariable anzuwenden. Mit erfundener IfDefine-Direktive umschliesst man die Zeilen und Blöcke diese temporär nicht genutzt werden. Oder etwa um ein Abschnitt auf seine Funktion bzw. nicht Funktion zu testen.