FortiManager fgfmd Missing Authentication RCE (FortiJump)
- Product
- Fortinet FortiManager
- CVE
- CVE-2024-47575
- Disclosed
- 2024-10-23
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- FortiManager 7.6.0, 7.4.0-7.4.4, 7.2.0-7.2.7, 7.0.0-7.0.12, 6.4.0-6.4.14, 6.2.0-6.2.12; FortiManager Cloud; FortiAnalyzer models with fgfm enabled.
- Fixed
- FortiManager 7.6.1, 7.4.5, 7.2.8, 7.0.13, 6.4.15, 6.2.13.
Summary
The FortiGate-to-FortiManager (FGFM) protocol daemon lacked authentication for critical functions, letting an attacker with any valid FortiGate certificate register a rogue device and execute commands on FortiManager. Mandiant tracked UNC5820 exploiting it to exfiltrate managed-device configurations and credentials.
Root cause
fgfmd on TCP 541 accepts device registrations based on certificates that can be extracted from any FortiGate, then exposes RPC functionality that writes files and runs commands without further authorization. This allows an unauthenticated (from FortiManager's perspective) attacker to achieve command execution.
Impact
Compromise of the central management server and all configurations, credentials and devices it manages.
Detection
Look for unknown devices in the device list, unexpected files such as /tmp/.tm, and connections to TCP 541 from untrusted IPs; Fortinet published IOCs.
Mitigation
Upgrade, use 'fgfm-deny-unknown', and restrict TCP 541 to known FortiGate IPs.