Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Ivar
New Contributor

CVE-2021-44228 Apache LOG4J vulnerability

Would appreciate a response from Fortinet regarding the Apache log4 vulnerability if any Fortinet product

is affected.

 

Any information regarding updated IPS signature for CVE-2021-44228?

1 Solution
Carl_Windsor_FTNT

PSIRT advisory on impacted products can be found here:

 

https://www.fortiguard.com/psirt/FG-IR-21-245

Dr. Carl Windsor Field Chief Technology Officer Fortinet

View solution in original post

44 REPLIES 44
AlexC-FTNT

Do you have a deep-inspection SSL profile on the policy? Generally, if the payload is encrypted (in HTTPS) the packet contents will not be verified with certificate-inspection only


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
FnUser
New Contributor

All signatures updated and properly configured, still not getting triggered. I hope FN will look into it. I can trigger other ones, but not the ID51006

boneyard
Valued Contributor

ok, saw other question, eventually it worked for something indeed.

DK2021
New Contributor
Carl_Windsor_FTNT

PSIRT advisory on impacted products can be found here:

 

https://www.fortiguard.com/psirt/FG-IR-21-245

Dr. Carl Windsor Field Chief Technology Officer Fortinet

View solution in original post

Deepak_Girimaji_FTNT

For FortiWEB, there is a new update for the WAF signatures to prevent attackers from performing variant remote code execution in Apache Log4j2 (CVE-2021-44228)
Reference: https://www.fortiguard.com/updates/websecurity?version=0.00306

 

 

Best regards,
Deepak G N R
Technical Lead Engineer
EMEA FortiWeb/ADC/WAN/DDoS/Isolator Team
Deepak_Girimaji_FTNT

There is a new update for the WAF signatures to prevent attackers from performing variant remote code execution in Apache Log4j2 (CVE-2021-44228)

Reference: https://www.fortiguard.com/updates/websecurity?version=0.00306

 

 

Best regards,
Deepak G N R
Technical Lead Engineer
EMEA FortiWeb/ADC/WAN/DDoS/Isolator Team
Carl_Windsor_FTNT

Note that the IPS signature changed to Default Block as of IPS DB 19.217

 

See our blog and advisory for more detail.

Dr. Carl Windsor Field Chief Technology Officer Fortinet

jsexton
New Contributor

We had a popup today on an end user machine indicated a detection and block for this. I can't find a reason for it, though. It's a workstation without Apache or Log4J installed. Does this plugin identify going to a vulnerable external website? My impression is that it only triggered on a machine if the machine itself was vulnerable.

Carl_Windsor_FTNT

Problem with this issue, the actual vulnerability can be behind the system being targetted (see the blog here).  FortiGate has no way of knowing if the server is vulnerable or of there is log4j somewhere in the path, just that the payload has been sent e.g. in a HTTP header.  This is the block you are seeing.

 

To know if you are potentially vulnerable, block outbound LDAP and look for triggers to the FW rule.

Dr. Carl Windsor Field Chief Technology Officer Fortinet