Item 2 in the brief for Mon, Oct 19

FortiOS flaw used to gain root and load the PEERSTITCH implant, Unit 42 says

Attackers used , a path traversal flaw in the FortiOS command line, to go from admin access to root on FortiGate firewalls, Unit 42 says. The flaw lets an admin with read-write rights write or delete files, and Fortinet released fixes in April for FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. Unit 42 tracks the attackers as CL-STA-0954, or UNC5820, and says they used it to load PEERSTITCH, a memory-resident implant that opens no listening ports. The victim was a telecom MSP, and Unit 42 dates the intrusion to September 2024 without dating this step.

Affected: FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9 and every 7.2, 7.0 and 6.4 version, plus FortiPAM, FortiProxy and FortiSwitchManager. All versions and fixes
CVE
Vendor: Fortinet
Published: Oct 19, 6:00 a.m. ET
Editor: Austin Simas

What to do

5 steps

1Upgrade FortiOS 7.6 to 7.6.5 or later and 7.4 to 7.4.10 or later, and migrate 7.2, 7.0 and 6.4 to a fixed release.
2Upgrade FortiProxy, FortiPAM and FortiSwitchManager to a fixed version, or migrate to a fixed release where Fortinet lists a whole branch as affected.
3Inspect the memory maps of miglogd and iked for anonymous 16,384-byte regions that are readable, writable and executable, a sign of PEERSTITCH, Unit 42 says.
4Run diagnose debug crashlog read and look for Signal 11 crashes in miglogd, iked or syslogd, another sign Unit 42 lists.
5Search FortiOS configuration revisions for system.auto-script objects containing ../../, the path traversal Unit 42 saw the attackers use.

Affected and fixed versions

Product	Affected	Fixed
FortiOS 7.6	`7.6.0` through `7.6.4`	`7.6.5` or later
FortiOS 7.4	`7.4.0` through `7.4.9`	`7.4.10` or later
FortiOS 7.2	All versions	Migrate to a fixed release
FortiOS 7.0	All versions	Migrate to a fixed release
FortiOS 6.4	All versions	Migrate to a fixed release
FortiPAM 1.7	`1.7.0`	`1.7.1` or later
FortiPAM 1.0 through 1.6	All versions	Migrate to a fixed release
FortiProxy 7.6	`7.6.0` through `7.6.4`	`7.6.5` or later
FortiProxy 7.4	`7.4.0` through `7.4.11`	`7.4.12` or later
FortiProxy 7.2	All versions	Migrate to a fixed release
FortiProxy 7.0	All versions	Migrate to a fixed release
FortiSwitchManager 7.2	`7.2.0` through `7.2.7`	`7.2.8` or later
FortiSwitchManager 7.0	`7.0.0` through `7.0.6`	`7.0.7` or later

Product
FortiOS 7.6
Affected
7.6.0 through 7.6.4
Fixed
7.6.5 or later
Product
FortiOS 7.4
Affected
7.4.0 through 7.4.9
Fixed
7.4.10 or later
Product
FortiOS 7.2
Affected
All versions
Fixed
Migrate to a fixed release
Product
FortiOS 7.0
Affected
All versions
Fixed
Migrate to a fixed release
Product
FortiOS 6.4
Affected
All versions
Fixed
Migrate to a fixed release
Product
FortiPAM 1.7
Affected
1.7.0
Fixed
1.7.1 or later
Product
FortiPAM 1.0 through 1.6
Affected
All versions
Fixed
Migrate to a fixed release
Product
FortiProxy 7.6
Affected
7.6.0 through 7.6.4
Fixed
7.6.5 or later
Product
FortiProxy 7.4
Affected
7.4.0 through 7.4.11
Fixed
7.4.12 or later
Product
FortiProxy 7.2
Affected
All versions
Fixed
Migrate to a fixed release
Product
FortiProxy 7.0
Affected
All versions
Fixed
Migrate to a fixed release
Product
FortiSwitchManager 7.2
Affected
7.2.0 through 7.2.7
Fixed
7.2.8 or later
Product
FortiSwitchManager 7.0
Affected
7.0.0 through 7.0.6
Fixed
7.0.7 or later

Indicators

IPs copy defanged. Use Copy raw for queries.

Type	Value	Note
IP address		Hosted the installer and PEERSTITCH in this intrusion, Unit 42 says
IP address		Hosted the installer and PEERSTITCH in this intrusion, Unit 42 says
IP address		Rogue FortiGate address the attackers added to FortiManager
IP address		Rogue FortiGate address the attackers added to FortiManager
SHA-256		PEERSTITCH core injector, an ARM64 Linux executable
SHA-256		PEERSTITCH staging and preparation script
SHA-256		Node.js script that deploys PEERSTITCH
File name		PEERSTITCH malware file name, per Unit 42

IP addressHosted the installer and PEERSTITCH in this intrusion, Unit 42 says
IP addressHosted the installer and PEERSTITCH in this intrusion, Unit 42 says
IP addressRogue FortiGate address the attackers added to FortiManager
IP addressRogue FortiGate address the attackers added to FortiManager
SHA-256PEERSTITCH core injector, an ARM64 Linux executable
SHA-256PEERSTITCH staging and preparation script
SHA-256Node.js script that deploys PEERSTITCH
File namePEERSTITCH malware file name, per Unit 42

Timeline

Apr 14Fortinet publishes fixes in advisory FG-IR-26-122.
Oct 14Unit 42 publishes its report on the intrusion and PEERSTITCH.
Oct 16CISA adds the flaw to KEV with an Oct 19 due date.

Sources

Fortinet PSIRTPrimary source fortiguard.fortinet.com
Unit 42Primary source unit42.paloaltonetworks.com
CISA KEV catalogPrimary source cisa.gov