{"id":952,"date":"2025-01-16T10:35:19","date_gmt":"2025-01-16T10:35:19","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/kriticna-fortiguard-ranjivost-omogucuje-stvaranje-admin-korisnika-cvss-9-6\/"},"modified":"2026-11-04T08:58:24","modified_gmt":"2026-11-04T08:58:24","slug":"kriticna-fortiguard-ranjivost-omogucuje-stvaranje-admin-korisnika-cvss-9-6","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/ranjivosti\/kriticna-fortiguard-ranjivost-omogucuje-stvaranje-admin-korisnika-cvss-9-6\/","title":{"rendered":"Kriti\u010dna FortiGuard ranjivost omogu\u0107uje stvaranje admin korisnika (CVSS 9.6)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong><a href=\"https:\/\/www.fortiguard.com\/psirt\/FG-IR-24-535\" target=\"_blank\" rel=\"noreferrer noopener\" title=\"https:\/\/www.fortiguard.com\/psirt\/FG-IR-24-535\">Ranjivost <\/a>zaobila\u017eenja autentifikacije<\/strong> kori\u0161tenjem alternativnog puta ili kanala [CWE-288] koja utje\u010de na <strong>FortiOS i FortiProxy<\/strong> mo\u017ee omogu\u0107iti udaljenom napada\u010du da dobije <strong>ovlasti super-administratora <\/strong>slanjem zahtjeva putem interneta prema Node.js pristupnom modulu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Ranjivost: <a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2024-55591\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2024-55591<\/a><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Izvje\u0161\u0107a pokazuju da napada\u010di ve\u0107 iskori\u0161tavaju ovu ranjivost.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do sad je uo\u010deno da su napada\u010di:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Stvarali admin ra\u010dune na ure\u0111aju s nasumi\u010dnim korisni\u010dkim imenom<\/li><li>Stvarali lokalne korisni\u010dke ra\u010dune na ure\u0111aju s nasumi\u010dnim korisni\u010dkim imenom<\/li><li>Stvarali korisni\u010dke grupe ili dodavali nove korisnike u postoje\u0107u sslvpn korisni\u010dku grupu<\/li><li>Dodavali\/mijenjali postavke (politika vatrozida, adresa vatrozida, \u2026)<\/li><li>Prijavljivali u sslvpn s dodanim lokalnim korisnicima za dobivanje tunela do interne mre\u017ee.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Ranjive ina\u010dice:<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><\/td><td><strong>Ranjive ina\u010dice<\/strong><\/td><td><strong>Rje\u0161enje<\/strong><\/td><\/tr><tr><td>FortiOS 7.0<\/td><td>7.0.0 do 7.0.16<\/td><td>Nadogradnja na verziju <strong>7.0.17<\/strong> ili noviju<\/td><\/tr><tr><td>FortiProxy 7.2<\/td><td>7.2.0 do 7.2.12<\/td><td>Nadogradnja na ina\u010dicu <strong>7.2.13<\/strong> ili noviju<\/td><\/tr><tr><td>FortiProxy 7.0<\/td><td>7.0.0. do 7.0.19<\/td><td>Nadogradnja na ina\u010dicu <strong>7.0.20<\/strong> ili noviju<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Ako koristite ranjive verzije, savjetujemo a\u017euriranje putem alata dostupnog na poveznici: <a href=\"https:\/\/docs.fortinet.com\/upgrade-tool\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/docs.fortinet.com\/upgrade-tool<\/a><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mogu\u0107e rje\u0161enja:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Onemogu\u0107i HTTP\/HTTPS administrativno su\u010delje<\/li><li>Ograni\u010dite IP adrese koje mogu do\u0107i do administrativnog su\u010delja<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Za vi\u0161e savjeta posjetite: <a href=\"https:\/\/www.fortiguard.com\/psirt\/FG-IR-24-535\" target=\"_blank\" rel=\"noreferrer noopener\">PSIRT | FortiGuard Labs<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Indikatori kompromitacije:<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Zapis prijave u sustav s nasumi\u010dnim scrip-om i dstip-om:<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">type=\"event\" subtype=\"system\" level=\"information\" vd=\"root\" logdesc=\"Admin login successful\" sn=\"1733486785\" user=\"admin\" ui=\"jsconsole\" method=\"jsconsole\" <strong>srcip=1.1.1.1 dstip=1.1.1.1<\/strong> action=\"login\" status=\"success\" reason=\"none\" profile=\"super_admin\" msg=\"Administrator admin logged in successfully from jsconsole\u201c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Zapis kreiranja admin korisnika \u010dudnog imena i izvornog IP-a:<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">type=\"event\" subtype=\"system\" level=\"information\" vd=\"root\" logdesc=\"Object attribute configured\" user=\"admin\" ui=\"jsconsole(127.0.0.1)\" action=\"Add\" cfgtid=1411317760 cfgpath=\"system.admin\" cfgobj=\"vOcep\" cfgattr=\"password[*]accprofile[super_admin]vdom[root]\" msg=\"Add system.admin vOcep<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Napada\u010di su u navedenim zapisima uglavnom koristili sljede\u0107e IP adrese:  <strong>1.1.1.1; 127.0.0.1; 2.2.2.2; 8.8.8.8; 8.8.4.4<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">*navedeni IP parametri nisu stvarne izvorne IP adrese napada\u010da. Napada\u010d ih proizvoljno generira kao parametar. Zbog toga se ne smiju koristiti za bilo kakvo blokiranje.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Tako\u0111er imajte na umu da sn i cfgtid nisu relevantni za napad.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Primjeri korisni\u010dkih imena koje su koristili za kreiranje admin korisnika: <strong>Gujhmk; Ed8x4k; G0xgey; Pvnw81; Alg7c4; Ypda8a; Kmi8p4; 1a2n6t; 8ah1t6<\/strong> i sl.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Napada\u010di su koristili i sljede\u0107e IP adrese:<\/strong> 45.55.158.47 <strong>[naj\u010de\u0161\u0107e kori\u0161tena IP adresa]<\/strong>; 87.249.138.47; 155.133.4.175; 37.19.196.65; 149.22.94.37<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>#SurfajSigurnije<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ranjivost zaobila\u017eenja autentifikacije kori\u0161tenjem alternativnog puta ili kanala [CWE-288] koja utje\u010de na FortiOS i FortiProxy mo\u017ee omogu\u0107iti udaljenom napada\u010du da dobije ovlasti super-administratora slanjem zahtjeva putem interneta prema Node.js pristupnom modulu. Ranjivost: CVE-2024-55591 Izvje\u0161\u0107a pokazuju da napada\u010di ve\u0107 iskori\u0161tavaju ovu ranjivost. Do sad je uo\u010deno da su napada\u010di: Stvarali admin ra\u010dune na ure\u0111aju s nasumi\u010dnim [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1522,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[],"tema":[],"class_list":["post-952","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ranjivosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/952","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=952"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/952\/revisions"}],"predecessor-version":[{"id":1525,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/952\/revisions\/1525"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1522"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=952"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=952"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=952"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=952"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=952"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}