The SANS Internet Storm Center recently highlighted two critical vulnerabilities impacting widely deployed network infrastructure: Fortinet FortiNAC and SonicWall SMA 100 series. These vulnerabilities, one an RCE and another an actively exploited Zero-Day SQL Injection, pose significant threats to organizational security, according to SANS Internet Storm Center. Defenders must prioritize immediate patching and mitigation strategies to prevent potential network compromise and data exfiltration.
Critical Vulnerabilities Overview
The current threat landscape highlights the urgency in addressing vulnerabilities within perimeter devices. Two such disclosures demand immediate attention from security professionals:
- Fortinet FortiNAC Multiple Vulnerabilities: Two distinct issues, identified as CVE-2023-33300 and CVE-2023-33299, impact Fortinet’s network access control solution. CVE-2023-33300 is a critical arbitrary code execution flaw, while CVE-2023-33299 is an OS command injection vulnerability. Both have high CVSS scores, 9.6 and 9.5 respectively, indicating severe potential impact.
- SonicWall SMA 100 Series Zero-Day: Tracked as CVE-2023-34124, this SQL Injection vulnerability affects SonicWall Secure Mobile Access (SMA) 100 series appliances. The critical aspect of this flaw is its active exploitation in the wild, prior to a comprehensive patch being widely available at the time of the advisory.
These vulnerabilities are significant because they target systems often deployed at the network edge, providing initial access to internal resources. Successful exploitation can enable threat actors to bypass security controls, achieve Privilege Escalation, execute arbitrary code, and facilitate Lateral Movement within an organization’s infrastructure.
Fortinet FortiNAC RCE & Command Injection Analysis
Fortinet FortiNAC appliances, specifically versions 9.4.0 through 9.4.2, are at risk from critical vulnerabilities. CVE-2023-33300 allows for arbitrary code execution due to improper neutralization of user-controlled input. This means an attacker can send specially crafted requests to a vulnerable FortiNAC appliance, potentially gaining full control over the system. Such a compromise on a network access control device could allow an attacker to onboard unauthorized devices, bypass network segmentation, or use the device as a staging ground for further attacks.
Complementing this, CVE-2023-33299 is an OS command injection flaw, also due to improper neutralization of special elements. This vulnerability, while slightly lower in CVSS score at 9.5, still presents a severe risk by allowing an attacker to execute arbitrary operating system commands. Both vulnerabilities exploit how the FortiNAC system handles specific incoming requests.
FortiNAC RCE CVE-2023-33300 Patching Guidance
Fortinet has released patches to address these vulnerabilities across multiple versions. Organizations running affected FortiNAC instances must upgrade to the patched versions immediately. The fixes are available in FortiNAC versions 9.4.3, 9.2.8, 9.1.5, 8.8.11, 8.6.6, and 8.5.5. Prioritizing these updates is paramount to prevent exploitation. In scenarios where immediate patching is not feasible, Fortinet also advises disabling the “saml-service” as a temporary workaround for these issues.
SonicWall SMA 100 Series Zero-Day SQL Injection Exploitation
The Zero-Day vulnerability in SonicWall SMA 100 series, CVE-2023-34124, affects versions 10.2.1.0 through 10.2.1.2. This vulnerability is an unauthenticated SQL Injection, meaning an attacker can inject malicious SQL queries into the application’s input fields. This can lead to unauthorized access to sensitive information within the database, or in some cases, database manipulation and even remote code execution. The critical concern with CVE-2023-34124 is its confirmed active exploitation in the wild, indicating that threat actors are already leveraging this flaw.
SMA 100 appliances are typically used for secure remote access, making them prime targets for initial compromise. Exploitation of such a device can grant attackers a foothold into the internal network, bypassing traditional perimeter defenses.
How to Mitigate SonicWall SMA 100 SQL Injection CVE-2023-34124
While a comprehensive patch was not immediately available at the time of the advisory, SonicWall released a hotfix to address the unauthenticated SQL Injection vulnerability. Organizations should apply this hotfix without delay. Furthermore, SonicWall strongly recommends restricting access to the SMA interface to trusted source IP addresses only. This network-level control significantly reduces the attack surface by preventing unauthorized external entities from even attempting to exploit the vulnerability. Implement strong authentication policies, including multi-factor authentication (MFA), for all SMA access, and ensure that all logs from SMA devices are forwarded to a SIEM for continuous monitoring.
Actionable Recommendations and Defensive Strategies
Given the criticality and active exploitation status of these vulnerabilities, security teams must act decisively.
- Immediate Patching: For Fortinet FortiNAC, prioritize applying the specified patches (9.4.3, 9.2.8, 9.1.5, 8.8.11, 8.6.6, 8.5.5). Verify successful installation and conduct post-patch validation.
- Hotfix and Access Control for SonicWall SMA: Apply the available hotfix for CVE-2023-34124 on affected SonicWall SMA 100 series versions (10.2.1.0-10.2.1.2). Simultaneously, restrict management and user access to the SMA interface via firewall rules, allowing connections only from known, trusted networks or IP addresses.
- Network Segmentation: Isolate FortiNAC and SonicWall SMA devices on dedicated network segments. This minimizes the impact of a compromise by limiting an attacker’s ability to perform Lateral Movement to critical internal systems.
- Enhanced Monitoring: Implement comprehensive logging and monitoring for both FortiNAC and SonicWall SMA devices. Forward logs to a SIEM or EDR solution. Security teams should be proactively looking for anomalous activity, such as unusual login attempts, unexpected command execution, or high data transfer volumes.
- Vulnerability Management: Regularly scan your external attack surface for these and other known vulnerabilities. Maintain an up-to-date asset inventory to ensure all exposed devices are accounted for and secured.
- Incident Response Preparedness: Review and update your incident response plans to account for potential compromise of network perimeter devices. Ensure playbooks include steps for isolating affected systems, forensic analysis, and rapid recovery. When detecting FortiNAC command injection exploitation, immediate isolation and investigation are crucial steps to contain further damage.
The exploitation of these critical network infrastructure components underscores the importance of a layered security approach and proactive vulnerability management. Organizations should assume that devices exposed to the internet are under constant scrutiny by threat actors and maintain a high level of vigilance.