Skip to main content

APTs Exploiting Multiple VPN Vulnerabilities

Public vulnerabilities in VPN products from several major network vendors are being exploited in ongoing attacks from multiple APT groups. The groups are using bespoke exploits to gain access to target networks through these VPN products.

Threat ID:
CC-3248
Category:
Exploit
Threat Severity:
Medium
Threat Vector:
Insecure network, Exploit, Vulnerability
Published:
9 October 2019 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Public vulnerabilities in VPN products from several major network vendors are being exploited in ongoing attacks from multiple APT groups. The groups are using bespoke exploits to gain access to target networks through these VPN products.

Threat details

Introduction

Known vulnerabilities in several virtual private network (VPN) products are being actively exploited by advanced persistent threat (APT) groups.

Details

If successful, these groups are able to extract sensitive information, alter network configurations, or take control of connected systems. The vulnerabilities lie in Secure Socket Layer (SSL/TLS) VPN products from Fortinet, Palo Alto Networks, and Pulse. A remote unauthenticated attacker could send specially crafted requests to the affected products in order to obtain arbitrary files, including those containing authentication credentials. These credentials can then be used to access vulnerable VPN systems, at which point the attacker may alter configuration settings or connect to internal systems.

Threat updates

Date Update
6 Aug 2020 Pulse VPN details posted on ransomware forum

Details on over 900 Pulse Connect Secure VPNs vulnerable to CVE-2019-11510 have bee posted on a number of hacking forums frequented by ransomware operators. The information includes:

  • unique device IP addresses
  • VPN firmware versions
  • administration account details
  • local user lists
  • hashed local user passwords
  • last login information, including username and password (in cleartext)
  • SSH keys
  • session cookies

All information appears to have been collected between 24/06/2020 and 08/07/2020.

Remediation advice

Affected organisations are encouraged to review the following security advisories and apply any relevant updates:

Organisations unable to update can apply the below partial mitigation steps.

Remediation steps

Type Step
Action

Update VPN account credentials and implement a suitable multi-factor authentication solution
Guidance

Restrict administrative access to dedicated internal management networks. Prevent administrative access to any public-facing VPN applications.
Action

Re-issue VPN server keys and certificates.
Guidance

Enable suitable VPN logging; including network metadata, configuration changes, and access attempts. Ensure these logs are reviewed periodically.
Aware

Ensure public-facing VPN applications use TLS 1.2 or newer.

CVE Vulnerabilities

Status Master

CVE-2018-13379

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
Status Master

CVE-2018-13382

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests.
Status Master

CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.10, 5.4.0 to 5.4.12, 5.2.14 and below in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
Status Master

CVE-2019-1579

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.
Status Master

CVE-2019-11510

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability.
Status Master

CVE-2019-11539

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

Last edited: 6 August 2020 10:49 am