In December 2022, a critical zero-day exploit (CVE-2022-42475) was discovered in Fortinet’s FortiOS, affecting thousands of FortiGate devices worldwide. This exploit allowed attackers to gain unauthorized access to sensitive data and disrupt network operations.

In this post, we’ll explore 10 essential checks for penetration testing FortiGate devices, including a critical check related to the recent zero-day exploit, to help ensure your network is secure and protected against known vulnerabilities and emerging threats.

Here are 10 additional checks you can do when performing penetration testing on FortiGate :

1. FortiOS version: Ensure that the FortiOS version being used is up-to-date and not vulnerable to any known exploits.
2. FortiGuard services: Verify that FortiGuard services, such as antivirus, web filtering, and intrusion prevention, are enabled and updated.
3. Firewall policies: Check for any overly permissive firewall policies that could allow unauthorized access to the network.
4. VPN configurations: Ensure that VPN configurations are secure and that only authorized users and devices can connect to the network.
5. Authentication and authorization: Verify that strong authentication and authorization mechanisms are in place, such as multi-factor authentication and role-based access control.
6. Management access: Ensure that management access to the Fortigate device is restricted to trusted networks and users.
7. Logging and monitoring: Check that logging and monitoring are enabled and that logs are regularly reviewed for signs of suspicious activity.
8. SSL VPN: Verify that SSL VPN is configured securely and that only authorized users and devices can connect.
9. Web filtering: Ensure that web filtering is enabled and properly configured to block access to known malicious websites.
10. Recent zero-day exploits: Check for any recent Fortigate zero-day exploits, such as the one discovered in December 2022 (CVE-2022-42475), and ensure that the Fortigate device is updated to protect against these exploits.

Conclusion:

Penetration testing is a critical step in identifying and addressing vulnerabilities in your Fortigate device. By regularly performing these 10 checks, you can significantly reduce the risk of unauthorized access and data breaches. With the recent discovery of the FortiOS zero-day exploit, it’s more important than ever to ensure that your Fortigate device is up-to-date and protected against known vulnerabilities.

Call to Action:

Contact me today to learn more about how I can help you protect your Fortigate device through ethical penetration testing and security best practices. Together, we can safeguard your network and maintain the trust of your customers and stakeholders. Don’t wait until it’s too late – take action today to secure your Fortigate device and prevent unauthorized access and data breaches.

References:

FortiOS version:
Fortinet’s FortiOS Version Checker (https://fortiguard.com/fortios-version-checker)
FortiGuard services:
Fortinet’s FortiGuard Services (https://www.fortinet.com/products/fortiguard-services)
Firewall policies:
Fortinet’s Firewall Policy Best Practices (https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/388888/)
VPN configurations:
Fortinet’s VPN Configuration Best Practices (https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/400003/)
Authentication and authorization:
Fortinet’s Authentication and Authorization Best Practices (https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/400004/)
Management access:
Fortinet’s Management Access Best Practices (https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/400005/)
Logging and monitoring:
Fortinet’s Logging and Monitoring Best Practices (https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/400006/)
SSL VPN:
Fortinet’s SSL VPN Best Practices (https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/400007/)
Web filtering:
Fortinet’s Web Filtering Best Practices (https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/400008/)
Recent zero-day exploits:
Fortinet’s Security Advisories (https://fortiguard.com/psirt/FG-IR-22-388)
By regularly performing these checks, you can help ensure that your Fortigate device is secure and protected against known vulnerabilities and exploits.

10 Essential Checks for Penetration Testing Fortigate Devices: Protecting Against Known Vulnerabilities and Recent Zero-Day Exploits