Fortinet CVE-2022-40684 Detection Scenario by crowdsecurity | CrowdSec Hub

Fortinet CVE-2022-40684

Attack scenariohttp:exploitMITRE T1548cve.CVE-2022-40684

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/CVE-2022-40684
Remediation: Ban

Detect cve-2022-40684 exploitation attempts

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/CVE-2022-40684

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/CVE-2022-40684.yaml· 19 linesGitHub

1type: trigger1
2name: crowdsecurity/fortinet-cve-2022-40684
3description: "Detect cve-2022-40684 exploitation attempts"
4filter: |2
5  evt.Meta.log_type in ["http_access-log", "http_error-log"] and 
6  Upper(evt.Meta.http_path) startsWith Upper('/api/v2/cmdb/system/admin/') and Lower(evt.Parsed.http_user_agent) == 'report runner'
7groupby: "evt.Meta.source_ip"3
8blackhole: 2m4
9labels:
10  type: exploit
11  remediation: true5
12  classification:6
13    - attack.T1548
14    - cve.CVE-2022-40684
15  spoofable: 0
16  confidence: 3
17  behavior: "http:exploit"
18  label: "Fortinet CVE-2022-40684"
19  service: fortinet

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

CVE-2022-40684

Detects FortiOs, FortiProxy, and FortiSwitchManager authentication bypass (CVE-2022-40684) vulnerability.