CVE-2022-40684: Administrative Interface Auth Bypass via 'Forwarded' Header
An authentication bypass using an alternate path or channel [CWE-288] in FortiOS administrative web server and REST API allows unauthenticated remote attackers to perform unauthorized operations via forged HTTP Forwarded headers.
Technical Root Cause Analysis
The FortiOS administrative interface daemon (/bin/httpsd) handles inbound HTTPS management requests and REST API calls. To facilitate communication between internal appliance processes (such as automated reporting workers and local proxy daemons), FortiOS implements an internal trust mechanism based on HTTP headers.
When processing HTTP requests, the daemon evaluates client headers including Forwarded, X-Forwarded-For, and User-Agent. If a request includes a spoofed header structure such as Forwarded: for="[127.0.0.1]:80";by="[127.0.0.1]:80" combined with a trusted internal client User-Agent (such as Report Runner), the authentication proxy logic erroneously flags the connection as trusted internal IPC traffic.
Because the internal proxy treats the request as already authenticated, subsequent administrative handlers process malicious requests directly, allowing threat actors to manipulate administrator accounts, exfiltrate full configuration backups, and append unauthorized SSH public keys to the root account.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.0 – 7.2.1 | 7.2.2+ | Strip HTTPS on WAN; set trusthost |
| FortiOS 7.0 | 7.0.0 – 7.0.6 | 7.0.7+ | Strip HTTPS on WAN; upgrade firmware |
| FortiProxy 7.2 | 7.2.0 | 7.2.1+ | Apply management local-in filter |
| FortiProxy 7.0 | 7.0.0 – 7.0.6 | 7.0.7+ | Upgrade to patched build |
| FortiOS 7.4 | Not Affected | 7.4.0+ Clean | Proxy header trust logic deprecated |
Platform Impact: Affects any FortiGate appliance running vulnerable firmware where HTTP or HTTPS administrative access is exposed to untrusted networks or WAN interfaces. FortiSwitchManager is also affected.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands via SSH or console to audit administrative access logs, inspect external interface bindings, and check admin lockout states:
Diagnostic Commands
# 1. Search recent system event logs for unauthorized admin logins and suspicious source IPs
execute log display | grep -E "user=\"admin\"|srcip="
# 2. Audit all network interfaces to detect public WAN interfaces exposing HTTP or HTTPS
show system interface | grep allowaccess
# 3. Check administrative lockout tables for brute-force or anomalous session locks
diagnose sys admin-lockout listRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
By providing spoofed 'Forwarded' HTTP headers (pointing to 127.0.0.1) and a 'Report Runner' User-Agent, attackers trick the internal HTTPS reverse proxy into authenticating requests as internal daemon processes.
Disable HTTPS and HTTP administrative access on all public-facing interfaces and apply strict trusthost IP subnet limits under config system admin.
FortiOS 7.2.2, 7.0.7, and all subsequent releases permanently remove trust in user-supplied Forwarded headers for administrative endpoints.