Fortinet Community
Recently active
Critical Vulnerability CVE-2024-1709 in ConnectWise ScreenConnect What is CVE-2024-1709? CVE-2024-1709 is a critical security vulnerability found in ConnectWise ScreenConnect, impacting versions up to 23.9.7. This vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). It enables unauthorized attackers to bypass authentication mechanisms by exploiting a flaw in URL path processing within ScreenConnect's .NET framework. The vulnerability arises from improper handling of URL paths, allowing attackers to manipulate them in a way that circumvents the authentication checks normally enforced by ScreenConnect. This exploit grants unauthorized access to sensitive functionalities or data that would typically require proper authentication. Due to its severity and potential impact, CVE-2024-1709 has been actively exploited in the wild. It has been added to CISA’s Known Exploited Vulnerabilities Catalog, indicating
What is CVE-2017-12615? CVE-2017-12615 is a critical vulnerability identified in Apache Tomcat versions 7.0.0 to 7.0.79 running on Windows systems. This vulnerability arises when HTTP PUTs are enabled by setting the `readonly` initialization parameter of the Default servlet to `false`. It permits the unauthorized upload and execution of JSP files via specially crafted requests, leading to potential remote code execution on the server. CVE-2017-12615 is a critical vulnerability found in Apache Tomcat versions 7.0.0 to 7.0.79 operating on Windows systems. This vulnerability is triggered when HTTP PUT requests are enabled by configuring the “readonly” initialization parameter of the Default servlet to “false”. Exploiting this flaw allows attackers to upload malicious JSP files through carefully crafted requests, thereby gaining unauthorized execution privileges on the server. This could potentially lead to remote code execution, posing serious security risks to the affe
How Critical is CVE-2024-30044 Microsoft SharePoint Server? CVE-2024-30044 is a critical remote code execution (RCE) vulnerability discovered in Microsoft SharePoint Server. It has received a CVSSv3 score of 8.8, highlighting its severity. This vulnerability poses a significant risk as it allows authenticated attackers with Site Owner privileges or higher to execute arbitrary code on the SharePoint Server. This means that attackers who exploit this flaw can potentially gain full control over the SharePoint environment, enabling them to manipulate data, compromise confidentiality, and disrupt services. Given its critical nature, administrators are urged to apply patches promptly and implement necessary security measures to protect SharePoint Server instances from exploitation. The Importance of Securing SharePoint Server Microsoft SharePoint Server is a platform that supports organizational functions like document management, collaboration, and web-
What is CVE-2018-11784? CVE-2018-11784 is an open redirect vulnerability impacting several versions of Apache Tomcat, specifically versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33, and 7.0.23 to 7.0.90. This vulnerability arises when the default servlet in Apache Tomcat incorrectly handles redirects to directories. For instance, if a user requests '/foo', the server might improperly redirect them to '/foo/' using a specially crafted URL, allowing an attacker to redirect to any URI. This could be exploited to redirect users to malicious websites without their knowledge. The Significance of Mitigating Open Redirect Vulnerabilities Open redirect vulnerabilities are crucial to mitigate because they can serve as a mechanism in phishing attacks, misleading users about the authenticity of a website. When exploited, these vulnerabilities allow attackers to redirect users from legitimate websites to malicious ones. This redirection can deceive users into believing the
Overview On October 10th, 2023, Google disclosed a zero-day vulnerability in the HTTP/2 protocol, resulting in the most significant attack reaching up to 398 million requests per second. Cybersecurity and Infrastructure Security Agency (CISA) also released an advisory on this DDoS attack on the same day. This vulnerability has been exploited in the wild from August 2023 through October 2023. This HTTP/2 vulnerability allows malicious actors to launch a DDoS attack targeting HTTP/2 servers. The attack sends a set number of HTTP requests to generate high traffic on the targeted HTTP/2 servers. Attackers can cause a significant increase in the request per second and high CPU utilization on the servers that eventually can cause resource exhaustion. FortiGuard Labs identified the Distributed Denial-of-Service (DDoS) attack technique is used in the wild for the CVE-2023-44487 vulnerability. This DDoS attack, known as 'HTTP/2 Rapid Reset', leverages a flaw in the implementatio
GitLab Slack/Mattermost Integration Vulnerability: CVE-2023-5356 What is CVE-2023-5356? The discovery of CVE-2023-5356 adds to the growing list of concerns for GitLab, a widely used platform for software development and version control. This vulnerability involves incorrect authorization checks in both the Community Edition (CE) and Enterprise Edition (EE) of GitLab, affecting versions from 8.13 up to 16.7.2, before specific updates. The security flaw allows a user to abuse Slack/Mattermost integrations to execute slash commands as another user, potentially leading to unauthorized actions within the GitLab environment. This security issue underscores the critical importance of maintaining rigorous security practices in software development and collaboration platforms. The potential for such vulnerabilities to be exploited can have far-reaching implications for both the security of code and the integrity of the development process. What
CVE-2024-3400: Palo Alto Network OS Command Injection Vulnerability in GlobalProtect Introduction A recent zero-day command-injection vulnerability, identified as CVE-2024-3400, has been discovered in Palo Alto Networks PAN-OS. This vulnerability has been assigned the highest possible severity score of 10.0 and can be exploited by an unauthenticated user to execute arbitrary commands on the target system with root privileges. The vulnerability was initially discovered and reported by Volexity. Following this, the Cybersecurity and Infrastructure Security Agency (CISA) included CVE-2024-3400 in its Known Exploited Vulnerability Catalog. In this blog, we will discuss the exploitation activity related to this vulnerability, as observed by Fortinet FortiGuard Labs Threat Intelligences. Additionally, we will explore a newly discovered Python-based backdoor and its unique interaction mechanism with the operator
We are thrilled to introduce our new Solution Pack, "Submit Your Content," alongside several updated connectors including the Cisco Meraki MX L7 Firewall (version 1.1.0) and Cisco Firepower (version 3.0.2). This release also features new connectors for SentinelOne, RSS Feed, and more. Check out the full list and links to explore these new features and enhancements since the last announcement Content-update-week-24-2024 Type Name Version Link Solution Pack Submit Your Content 1.0.0 Link Widget Submit Content Form 1.0.0 Link Connector Slack 3.2.0 Link Connector TAXII2 Threat Intel Feed 1.0.1 Link Connector Cisco Meraki MX L7 Firewall 1.1.0 Link Connector Cisco Firepower 3.0.2 Link Connector SentinelOne 3.4.0 Link Connector RSS Feed 1.0.0 Link Connector Database 2.2.1 Link Connector Web Screenshot 1.0.0 Link Connector NetScaler ADC 1.0.0 Link Connector Cyble Vision 1.0.0 Link
Operational technology (OT) organizations across many industries are using technology to transform their business, but these benefits can lead to increased risks as well. Granting third-party contractors and remote employees remote access to OT systems presents a unique challenge because these remote endpoints are often unable to have endpoint security agents installed, leaving the OT network vulnerable to misuse and other insider threats. FortiSRA helps OT organizations implement secure remote access, mitigating the risk associated with maintaining external access to critical OT resources. FortiSRA is an agentless solution, so OT organizations can employ remote protections without having to deploy a software agent on third-party and remote employee endpoints. FortiSRA offers a rich set of capabilities and controls to help secure remote access and encourage safe transformation for OT organizations. Features include: &nbs
We are thrilled to announce new updates to our platform, featuring Solution Packs and Connectors to enhance cybersecurity operations. These enhancements will improve integration and streamline security operations. The table below outlines the advancements achieved since the last announcement, detailed in the Content-update-week-22-2024 post. Type Name Version Link Solution Pack Outbreak Response - Oracle WebLogic Server Vulnerability 1.0.0 Link Solution Pack Outbreak Response - PHP RCE Attack 1.0.0 Link Connector Micro Focus Service Manager 1.4.0 Link Connector AWS SQS 1.0.1 Link Connector SCP 1.0.1 Link Connector Check Point Firewall 2.1.0 Link Connector Cisco Umbrella Enforcement 3.0.1 Link Connector Fortinet FortiGate 5.3.0 Link Connector Google Cloud Compute 1.2.0 Link Connector ZeroFox 1.0.1 Link Connector Forcepoint DLP 1.0.0 Link Connector SOCRadar 1.0.0 Link Connector OTbase Inventory 1.0.0 Link Connector Datadog Cloud SIEM 1.0.
Fortinet has just announced FortiAIOps, an Artificial Intelligence with Machine Learning (AI/ML) tool for network operations. “Wait,” some people may ask, “isn’t Fortinet, a security company? Yes, it is, but it is also a networking company, as in “Security-Driven Networking.” The objective of network operations, in general, is evolving to focus on the quality of the end-user experience. It is not just a matter of, “Is everything up” but “is everything working well?” A holistic view of the network is needed, starting at the LAN Edge – where the users are – and Fortinet has been a leader in unified networking. Among Fortinet customers, 40% of network operations trouble tickets are connectivity issues. “The Wi-Fi is down.” I’m a Wi-Fi guy. Properly designed Wi-Fi is rarely the problem. That said, there can be DHCP issues, DNS issues, VLAN configurations, fat-fingered passwords, and, occasionally, radio frequency (RF) problems. It is bad enough when things are not working, but what about
We are excited to announce new releases across our solution packs, widgets, and connectors. Highlights include Outbreak Response - D-link Multiple Devices Attack (v1.0.0), FortiManager ZTP Flow (v1.0.3), Picklist as Phases (v1.0.1), Custom Picklist Message (v1.1.2), Fortinet FortiRecon EASM (v1.1.0), CrowdStrike Falcon (v2.4.0), Check Host (v1.0.0), Claroty XDOME (v1.0.0), Tor (v2.0.0), Utilities (v3.3.1), and Vectra (v3.1.0). Upgrade now to enhance your security and streamline operations. The table below outlines the advancements achieved since the last announcement, detailed in the Content update - week 20/2024. Type Name Version URL Solution Pack FortiManager ZTP Flow - Feature Examples 1.0.3 Link Solution Pack Outbreak Response - D-link Multiple Devices Attack 1.0.0 Link Solution Pack FortiManager ZTP Flow 1.0.3 Link Widget Picklist as Phases 1.0.1 Link Widget Custom Picklist Message 1.1.2 Link Connector Fortinet FortiRecon EASM 1.1.0 Link Connector Cro
In the rapidly evolving landscape of cybersecurity, effective governance is paramount. With the release of NIST Cybersecurity Framework (CSF) 2.0, organizations now have an enhanced toolset to manage and reduce cybersecurity risks. FortiSOAR, a robust Security Orchestration, Automation, and Response (SOAR) platform, plays a critical role in reinforcing governance across all phases of the NIST CSF 2.0. This blog explores how FortiSOAR empowers organizations to implement the framework's guidelines effectively. Introduction to NIST CSF 2.0 The NIST Cybersecurity Framework 2.0 provides comprehensive guidance for organizations to manage cybersecurity risks. It expands its scope beyond critical infrastructure to include all types and sizes of organizations, introducing a new "Govern" function to emphasize the importance of cybersecurity governance as a major enterprise risk. Read more about NIST CSF 2.0 here. How FortiSOAR Enhances Governance Across NIST CSF 2.0 Phases 1. Identify As
We are excited to announce new releases! Check out our latest solution packs: SOC Simulator v1.0.3, Outbreak Response for Zoho ManageEngine Vulnerability v1.0.0, and Black Basta Ransomware v1.0.0. We've also updated and added new connectors: Fortinet FortiSIEM v5.2.1, AWS S3 v3.0.2, Microsoft Defender For Cloud v1.2.0, Polar Security v1.0.0, Microsoft Advanced Threat Analytics v1.0.0, Exchange v4.4.0, and Taegis XDR v1.2.0. The table below outlines the advancements achieved since the last announcement, detailed in the FortiSOAR Content Update: Week 18, 2024 post. Type Name Link Solution Pack SOC Simulator v1.0.3 link Solution Pack Outbreak Response - Zoho ManageEngine Vulnerability v1.0.0 link Solution Pack Outbreak Response - Black Basta Ransomware v1.0.0 link Connector Fortinet FortiSIEM v5.2.1 link Connector AWS S3 v3.0.2 link Connector Microsoft Defender For Cloud v1.2.0 link Connector Polar Security v1.0.0 link Connector Microsoft Advanced Threat A
A Fortune 500 warehouse club operator faced challenges in enhancing their security design and best practices within their AWS infrastructure. They turned to Fortinet Cloud Consulting Services for strategic development of a comprehensive security design tailored to their needs. Expertise in Selecting the Right Cloud Architecture Fortinet Cloud Consulting Services team initiated a detailed consultation process, expertly building an architecture that flawlessly incorporated the FortiGate Next Generation Firewall into a central network Security Virtual Private Cloud (VPC) for deep packet inspection. The designed architecture emphasized scalability, reliability, cybersecurity, and robustness. Fortinet architects thoroughly analyzed the existing environment and requirements to develop solution options. A notable aspect of this collaboration was the comprehensive evaluation of diverse architectural designs. The Fortinet consultants outlined multiple options, highlighting their u
A prominent US-based specialty engineering and construction company faced challenges centralizing security controls, gaining visibility into traffic patterns and intrusion attempts, and applying policies at the application level within their cloud infrastructure. They turned to Fortinet Cloud Consulting Services to develop a comprehensive cloud network security design tailored to their unique requirements to ensure top-tier security and operational efficiency on AWS. Guided Expertise in Selecting the Right Cloud Architecture The Fortinet Cloud Consulting Services team worked closely with the customer to create an architecture that emphasized scalability, reliability, and robustness. The Fortinet consultants outlined multiple options, highlighting their unique benefits and potential challenges. This in-depth analysis enabled the customer to make informed decisions, ensuring their infrastructure not only satisfied current needs but was also adaptable for future advancements
Background When attackers access a victim device and determine they want to run commands on that device in the future, they often install backdoor implants. A feature of these implants is the ability to beacon to an attacker's Command & Control (C2) server. Each beacon is a callback that tells the attacker the implant is still active and then retrieves and executes instructions assigned to the implant. One example of these instructions is tasking the implant to execute automated commands (such as changing the frequency of beacons, looking for information stored on the device, scanning the network for vulnerabilities, or attempting to exploit additional machines) and transmitting the results back to the C2 server. This workflow allows the attacker to operate asynchronously by assigning instructions to multiple devices, knowing they will be executed in the near future. Alternatively, when an attacker needs to interactively execute a series of specific commands based on quickly analyz
Fortinet FortiSOAR introduces solution packs for handling outbreaks of Akira Ransomware and C-DATA Web Management System RCE Attacks, providing comprehensive response strategies. Additionally, new connectors for Google Calendar, JumpCloud, Google Docs, Azure Blob Storage, and Cloudflare WAF enhance integration capabilities across various platforms, enhancing security and operational efficiency. The table below outlines the advancements achieved since the last announcement, detailed in the Content update week 16, 2024 post. Type Name Version Link Solution Pack Outbreak Response: Akira Ransomware v1.0.0 Link Solution Pack Outbreak Response: C-DATA Web Management System RCE Attack v1.0.0 Link Connector Google Calendar v1.0.0 Link Connector JumpCloud v2.0.0 Link Connector Google Docs v1.0.0 Link Connector Azure Blob Storage v1.2.0 Link Connector Cloudflare WAF v1.0.0 Link
Introducing the latest additions to our FortiSOAR ecosystem! Our Solution Packs now include Outbreak Sunhillo SureLine Command Injection Attack SP and Outbreak Response - PAN-OS GlobalProtect Command Injection Vulnerability, empowering users with proactive defense measures. Additionally, our suite of Connectors has expanded to include Micro Focus SMAX v1.0.0, Netbox v1.0.0, PaloAlto Firewall v3.1.1, Microsoft Graph API v2.1.0, ElasticSearch v3.0.0, Zscaler v2.0.0, Anomali ThreatStream v2.5.0, Azure Commands v1.0.0, and MISP v2.1.0. With these enhancements, users can seamlessly integrate diverse security tools, enabling streamlined threat detection and response workflows. The table below outlines the advancements achieved since the last announcement, detailed in the Content update for week 14, 2024 post. Type Name Link Solution Pack Outbreak Sunhillo SureLine Command Injection Attack SP Link Solution Pack Outbreak Response - PAN-OS GlobalProtect Command Injection Vulnerability
Another Critical Vulnerability in Apache Struts: CVE-2023-50164 Vulnerability Overview Another one? Apache Struts seems to be experiencing quite a series of vulnerabilities. Apache Struts has been a target for malicious actors due to its widespread adoption and the potential impact of vulnerabilities within applications built on the framework. One of the most notable instances was the Equifax data breach in 2017, where attackers exploited a vulnerability in Apache Struts to gain unauthorized access to sensitive data. The Equifax breach was a wake-up call for many organizations regarding keeping frameworks and libraries up-to-date and implementing robust security measures in their web applications. Since then, there has been increased awareness and emphasis on regularly patching and securing Apache Struts applications to mitigate the risk of exploitation by cybercriminals. Fortinet Product Security Incident Response Team (PSIRT) continuously works to identify and address
In our latest release, FortiSOAR takes a significant leap forward by integrating cutting-edge AI technologies to empower security teams. At the forefront is FortiAI, a groundbreaking solution driven by Generative AI. FortiAI revolutionizes security operations by providing contextual responses, generating playbook blocks, and offering tailored insights into security threats, response processes, and more. But the innovation doesn't stop there. Our release introduces a diverse range of widgets designed to enhance visualization and streamline workflows. From the SOC Overview Sankey widget to the AI Assistant, these intuitive tools offer seamless integration and facilitate efficient decision-making in security operations. Complementing these advancements are a suite of connectors, including OpenAI, Symantec Messaging Gateway, and KnowB4 PhishER, among others. These connectors expand integration possibilities, allowing for enhanced collaboration and automation across security environments. &
FortiSOAR FortiAI is a cutting-edge tool designed to assist security operations teams in streamlining their workflow processes. It offers features such as generating playbooks for security use cases, providing contextual answers to questions, and assisting with Jinja expressions. Users can leverage its capabilities to automate and enhance their security operations, making them more efficient and effective. Benefits of FortiAI are: Customized SOC Questions: The analyst can now define specific questions tailored to their organization's security needs. For instance, they may set prompts like "Get Alert Summary" or "Generate Investigation Report" to quickly gather crucial information during an incident. Smarter Playbook Generation: With the enhanced playbook generation mode, the analyst can prioritize steps based on installed connectors, ensuring a more coherent response strategy. This means faster and more effective incident resolution. Simplified Configuration: The analyst can easily co
Fortinet is pleased to announce that FortiExtender Cloud 24.1 has just been released. The time has come to use wireless LAN access on FEV211F and FEV-211F-AM! This release brings the following improvements: FEV211F/FEV211F-AM Wireless support SSIDs – The user can configure the SSID profiles and push configuration to the FEX devices WIFI Configuration – The user can configure the different types of Security profiles and sync to the FEX devices Radios – The user can configure 2.4 and 5 GHz radios and sync to an FEX device SSIDs, Wi-Fi Configuration, and Radio configuration parameters can be applied: Inside the Profile Per-device override option available by clicking on In-service -> click on SN -> Click on Edit - SSIDs, WIFI Configuration, and Radio parameter Public Documentation was also updated. Admin Guide A few Screenshots: Profile SSID Configuration Wi-Fi Configu
We're excited to share some fantastic news with you all: the integration of Source Control, marking a significant milestone in content development lifecycle management across multiple FortiSOAR environments. This integration ensures a smooth transition through Development, Staging, and Production stages, enhancing efficiency and ease of use. Our latest offerings include the SOAR Framework Solution Pack (SFSP) and the FortiSOAR Solution Pack for Threat Intelligence Management. Our updates also include enhancements aimed at facilitating end-to-end malware incident management, starting from initial alert investigation to comprehensive remediation actions. We're introducing new widgets and connectors to streamline various processes such as Playbook Buttons, Playbook Execution Wizard, Record Card, JSON to grid for data visualization, CICD Configuration Wizard for CI/CD, and Record CTA Card for incident response. To foster stronger integrations, we've expanded our connector support
Just Released! FortiNDR Cloud Integration for Microsoft Sentinel Hello Fortinet Community! We’re excited to announce a new integration for FortiNDR Cloud! The FortiNDR Cloud, Microsoft Sentinel integration provides Sentinel customers with a single pane of class for all your threat intelligence use-cases and malicious network activity detections, streamlining response efforts across the SOC. The solution is on the Azure Marketplace here. The integration ensures all FortiNDR Cloud detections will be seamlessly ingested by Microsoft Sentinel. As an example – We detected the recent AnyDesk Cyber incident within FortiNDR Cloud. Now, it can be investigated right from the Microsoft Sentinel dashboard, along with other network vulnerability detections. FortiNDR Cloud currently supports integrations with Splunk, Qradar, FortiSIEM, and Cortex. For a list of existing integrations please refer to our documentation here. Click here for ou
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
