Technical Tip : Using FortiAnalyzer to detect Sysrv-K_Botnet Vulnerability | CVE-2022-22947.

[ck_FTNT]

Description	This article describes how to use a custom event handler in FortiAnalyzer to raise alerts for incident response related to attacks that attempt to leverage the Spring Cloud Gateway Actuator Endpoint Remote Code Execution vulnerability.
Scope	This event handler and report help to detect attempts to send specially crafted HTTP requests to vulnerable Spring Cloud Gateway Actuators in order to gain control of vulnerable systems, based on logs from FortiGates, FortiClients, and FortiSandbox.
Solution	Due to a flaw in the Actuator endpoint of Spring Cloud Gateway, when a user enables and exposes an insecure Gateway Actuator endpoint, Applications using Spring Cloud Gateway are vulnerable to code injection attacks. Unauthenticated attackers can achieve remote code execution by sending specially crafted SpEL expressions to the target system for injection.  What is included in Fortinet_Sysrv-K_Botnet.zip? 1) Sysrv-K_Botnet_event-handler.json This event handler helps identify logs created when the specially crafted HTTP requests are detected by FortiGate, FortiClient, and FortiSandbox logs. 2) Sysrv-K_Botnet_report.dat This report displays the findings on Sysrv-K_Botnet attacks from FortiGate, FortiClient, and FortiSandbox logs.  3) fgt_Sysrv-K_Botnet_event-handler.json The event handler for FortiGate ADOMs is configured for FortiGate logs only. 4) fgt_Sysrv-K_Botnet_report.dat The report for FortiGate ADOMs includes FortiGate charts only. All screenshots provided below are for illustration purposes and taken from FortiAnalyzer 7.0.3. 1) Download the Fortinet_Sysrv-K_Botnet.zip file (contains 4 files). 2) Unzip Fortinet_Sysrv-K_Botnet.zip. 3) Import Sysrv-K_Botnet_event-handler.json or fgt_Sysrv-K_Botnet_event-handler.json event handler: - Choose an ADOM (if ADOMs are enabled). The ADOM may be of type Fabric or FortiGate: - Choose the FortiSOC module.  - Select Event Handler List. - Select the Import option under More. - Select the appropriate event handler depending on the ADOM type. Result: The event handler is enabled and will be triggered if the appropriate logs are received following the import of the event handler.  Edit the event handler to customize the notification section. 4) Import Sysrv-K_Botnet _report.dat or fgt_Sysrv-K_Botnet_report.dat to Reports: - Choose an ADOM (if ADOMs are enabled). ADOM may be of type Fabric or FortiGate. - Choose the Report module. - Select the Import option under 'More'. - Select the appropriate file for the ADOM type to add the report to the ADOM. Result:  The (fgt)Sysrv-K_Botnet_report can be run anytime as determined by an admin user.