Vendor: Fortinet Product: FortiSIEM Tested version: 5.2.5, 5.2.6. I haven't confirmed older versions, but there is a good chance they're also affected. CVE: Fortinet hands out their own CVEs according to Mitre, and since no human confirmation was received by Fortinet, no CVE was created yet. == Summary: FortiSIEM has a hardcoded SSH public key for user "tunneluser" which is the same between all installs. An attacker with this key can successfully authenticate as this user to the FortiSIEM Supervisor. The unencrypted key is also stored inside the FortiSIEM image. While the user's shell is limited to running the /opt/phoenix/phscripts/bin/tunnelshell script, SSH authentication still succeeds. == Timeline: Dec 2, 2019: Email sent to Fortinet PSIRT with vulnerability details. Dec 3, 2019: Automated reply from PSIRT that email was received. Dec 23, 2019: Sent a reminder email to PSIRT about requesting a human confirmation. Jan 3, 2019: Public Release No human response was received by Fortinet for over 30 days. I stated that if a confirmation was received before January 2nd that they would be given an additional 60 days (90 days from initial release) to resolve the vulnerability before releasing it publicly. No such response was received, so it's now being publicly released. == Workaround: Clear out (or delete) the /home/tunneluser/.ssh/authorized_keys file on the Supervisor: supervisor# echo "" > /home/tunneluser/.ssh/authorized_keys OR supervisor# rm /home/tunneluser/.ssh/authorized_keys Also, ensure any of your nodes are behind firewalls with only trusted access to ports. == Details: The FortiSIEM Supervisor has 2 different sshd daemons listening: one is on the standard port 22/tcp, and the other on port 19999/tcp): supervisor# netstat -lnp |grep sshd tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 38593/sshd tcp 0 0 0.0.0.0:19999 0.0.0.0:* LISTEN 38615/sshd tcp 0 0 :::22 :::* LISTEN 38593/sshd tcp 0 0 :::19999 :::* LISTEN 38615/sshd The sshd daemon on 19999/tcp uses its own configuration file: Supervisor# ps aux |grep 38615 root 38615 0.0 0.0 66288 512 ? Ss Sep25 0:00 /usr/sbin/sshd -p 19999 -f /etc/ssh/sshd_config.tunneluser When looking for this user under ssh configuration files, the sshd 19999/tcp only allows tunneluser to authenticate: supervisor# grep -R tunneluser /etc/ssh/ /etc/ssh/sshd_config.tunneluser:AllowUsers tunneluser@* /etc/ssh/sshd_config.tunneluser:DenyUsers "!tunneluser@*,*" Note that there's no DenyUsers tunneluser@* for the standard sshd configuration. This means that tunneluser can also successfully authenticate over sshd port 22/tcp. The Supervisor has an entry for tunneluser in its passwd file: supervisor# grep tunneluser /etc/passwd: tunneluser:x:501:502::/home/tunneluser:/opt/phoenix/phscripts/bin/tunnelshell The Supervisor allows tunneluser to connect with the following SSH key, and forward port 2 to localhost. I've confirmed with other users of FortiSIEM that this key is the same for other installs as well. It is not auto-generated for each FortiSIEM instance: supervisor# cat /home/tunneluser/.ssh/authorized_keys permitopen="127.0.0.1:2" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArtFWNhmJqezB0NC5NAbWGZBDWHpGsB+d0+bI46mIJMVyfLhuIa5s5iZF30ehRxu0tTILp40EDe5S9VkdlOymJFvA3dUTlfuhwKvV1hUHXe/5ARTC8AX+1QeZDGnzUKBp/64in6STyaG/1KZj0U1rKUTH42SJWjTrvE/vHqilrcY9SmPx498mPzR8CvlJKYCm1WvweIUoqiVnIqIAQrZqTR+0ea1LksQ6YP4PqpTZpe495bIhk+f2pwPI6PU2q0X61Ae99kqo07whoktb3NdNSI9y/yWJleKdw/FaR0Cj7Ilqg3KyR8evHQoOTHpWiTRAPOpo82qfbx6W0ykrRjo/QQ== builder@ao-build The corresponding SSH Private Key is located on all nodes (Supervisor, Collector, etc.) under the /opt/phoenix/id_rsa.tunneluser file. Running the following command confirms that this key matches that of the public key: # ssh-keygen -y -f /opt/phoenix/id_rsa.tunneluser ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArtFWNhmJqezB0NC5NAbWGZBDWHpGsB+d0+bI46mIJMVyfLhuIa5s5iZF30ehRxu0tTILp40EDe5S9VkdlOymJFvA3dUTlfuhwKvV1hUHXe/5ARTC8AX+1QeZDGnzUKBp/64in6STyaG/1KZj0U1rKUTH42SJWjTrvE/vHqilrcY9SmPx498mPzR8CvlJKYCm1WvweIUoqiVnIqIAQrZqTR+0ea1LksQ6YP4PqpTZpe495bIhk+f2pwPI6PU2q0X61Ae99kqo07whoktb3NdNSI9y/yWJleKdw/FaR0Cj7Ilqg3KyR8evHQoOTHpWiTRAPOpo82qfbx6W0ykrRjo/QQ== This means that anyone with access to any FortiSIEM image (to copy the SSH private key) can authenticate successfully via SSH to the FortiSIEM Supervisor on port 19999/tcp as tunneluser. They will be limited to the /opt/phoenix/phscripts/bin/tunnelshell script, but if this is bypassed then full shell access can be obtained. iptables and ip6tables are present on the Supervisor. However, they are both permissive and accept all traffic destined to them: supervisor# iptables -L Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ... supervisor bin]# ip6tables -L Chain INPUT (policy ACCEPT) target prot opt source destination ...