Hardcoded SSH Key Found in Fortinet SIEM Appliances

guest · Jan 21, 2020

Hardcoded SSH Key Found in Fortinet SIEM Appliances
January 20, 2020
https://www.securityweek.com/hardcoded-ssh-key-found-fortinet-siem-appliances

The hardcoded SSH key is for the user 'tunneluser', is the same between installs and is also stored unencrypted in the FortiSIEM image. As a result, an attacker could retrieve it and use it to sign into the FortiSIEM Supervisor without authentication.

“While the user's shell is limited to running the /opt/phoenix/phscripts/bin/tunnelshell script, SSH authentication still succeeds,” Cybera Inc Security Specialist Andrew Klaus explained.
Tracked as CVE-2019-17659, the vulnerability could lead to denial of service, security solutions provider Fortinet notes in an advisory.
The company also explains that the user 'tunneluser' only runs in a restricted shell “that lets only that user create tunnel connections from the supervisor to the originating IP.”

Fortinet advises customers who are not using the reverse tunnel feature to disable SSH on port 19999.
Moreover, the security company advises customers to also disable 'tunneluser' SSH access on port 22.
Click to expand...

guest · Jan 27, 2020

Fortinet removes SSH and database backdoors from its SIEM product
Patches have been released for CVE-2019-17659 and CVE-2019-16153
January 27, 2020
https://www.zdnet.com/article/fortinet-removes-ssh-and-database-backdoors-from-its-siem-product/

SSH BACKDOOR
On January 15, Fortinet released a patch for FortiSIEM which removed a backdoor in the SIEM's SSH connection feature.
"An attacker with this key can successfully authenticate as this user to the FortiSIEM Supervisor. The unencrypted key is also stored inside the FortiSIEM image," he said.
Companies are advised to install Fortinet's patch for CVE-2019-17659 [...]
THE DATABASE BACKDOOR
But there is also a second backdoor-like mechanism in Fortinet's FortiSIEM. On January 12, Fortinet also patched CVE-2019-16153.
This patch removes a hardcoded password from the FortiSIEM database component that could allow attackers to access the device database via the use of static credentials.
Click to expand...

Log in or Sign up

Hardcoded SSH Key Found in Fortinet SIEM Appliances

guest Guest

guest Guest

Log in or Sign up

Hardcoded SSH Key Found in Fortinet SIEM Appliances

guest Guest

guest Guest

Useful Searches