Fortinet Auto USB Installation Enabled - Detect

ID: auto-usb-install

Severity: info

Author: pussycat0x

Tags: audit,config,file,firewall,fortigate

Description

Via Fortinet Auto USB installation, an attacker with physical access to a FortiGate can load a new configuration or firmware using the USB port, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.

YAML Source

id: auto-usb-install

info:
  name: Fortinet Auto USB Installation Enabled - Detect
  author: pussycat0x
  severity: info
  description: Via Fortinet Auto USB installation, an attacker with physical access to a FortiGate can load a new configuration or firmware using the USB port, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference: https://docs.fortinet.com/document/fortigate/6.2.0/hardening-your-fortigate/582009/system-administrator-best-practices
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0
    cwe-id: CWE-200
  tags: audit,config,file,firewall,fortigate

file:
  - extensions:
      - conf

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "set auto-install-config disable"
          - "set auto-install-image disable"
        negative: true

      - type: word
        words:
          - "config system"
          - "config router"
          - "config firewall"
        condition: or
# digest: 4a0a0047304502204c2aa5f9a0aedf4f889bcbbea089fc5c37d34810b115fbf4d9a61235de947bc102210095c900b914b8630cae1b454f5b601bdb44a23b100668ce80cb9ee46b85a0ac35:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "file/audit/fortigate/auto-usb-install.yaml"

View on Github