{"id":3858,"date":"2024-04-03T16:20:08","date_gmt":"2024-04-03T21:20:08","guid":{"rendered":"https:\/\/www.itechsas.com\/blog\/?p=3858"},"modified":"2024-04-03T16:20:09","modified_gmt":"2024-04-03T21:20:09","slug":"alerta-por-vulnerabilidad-critica-de-fortinet-que-esta-siendo-explotada","status":"publish","type":"post","link":"https:\/\/www.itechsas.com\/blog\/ciberseguridad\/alerta-por-vulnerabilidad-critica-de-fortinet-que-esta-siendo-explotada\/","title":{"rendered":"Alerta por vulnerabilidad critica de Fortinet que esta siendo explotada"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>La agencia de ciberseguridad estadounidense -CISA- advierte a las empresas que una vulnerabilidad en el servidor de gesti\u00f3n empresarial (EMS) Fortinet FortiClient recientemente revelada como CVE-2023-48788 est\u00e1 siendo explotada en ataques.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La vulnerabilidad que afecta a la soluci\u00f3n de gesti\u00f3n de endpoints empresariales  (EMS FortiClient) se ha descrito como un\u00a0<strong>error cr\u00edtico de inyecci\u00f3n SQL<\/strong> valorado con un <strong>puntaje de 9.3<\/strong>,\u00a0que puede ser aprovechado por un atacante no autenticado para ejecutar c\u00f3digo arbitrario o comandos mediante solicitudes especialmente dise\u00f1adas.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-10.png\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"515\" src=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-10-1024x515.png\" alt=\"\" class=\"wp-image-3859\" srcset=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-10-1024x515.png 1024w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-10-300x151.png 300w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-10-768x386.png 768w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-10-830x417.png 830w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-10.png 1175w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption class=\"wp-element-caption\"><a href=\"https:\/\/fortiguard.fortinet.com\/psirt\/FG-IR-24-007\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/fortiguard.fortinet.com\/psirt\/FG-IR-24-007 <\/a><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">El Centro Nacional de Seguridad Cibern\u00e9tica (NCSC) del Reino Unido y un empleado de Fortinet han sido acreditados por descubrir el CVE-2023-48788.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prueba de concepto de explotaci\u00f3n <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">El 21 de marzo, la empresa de ciberseguridad Horizon3.ai revel\u00f3\u00a0<a href=\"https:\/\/www.horizon3.ai\/attack-research\/attack-blogs\/cve-2023-48788-fortinet-forticlientems-sql-injection-deep-dive\/\" target=\"_blank\" rel=\"noreferrer noopener\">detalles t\u00e9cnicos<\/a>\u00a0de la vulnerabilidad y public\u00f3 un exploit de prueba de concepto (PoC).<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-11.png\"><img decoding=\"async\" width=\"1024\" height=\"293\" src=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-11-1024x293.png\" alt=\"\" class=\"wp-image-3860\" srcset=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-11-1024x293.png 1024w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-11-300x86.png 300w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-11-768x219.png 768w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-11-830x237.png 830w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-11.png 1162w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption class=\"wp-element-caption\">B\u00fasqueda de cadenas SQL.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-12.png\"><img decoding=\"async\" width=\"753\" height=\"388\" src=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-12.png\" alt=\"\" class=\"wp-image-3861\" srcset=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-12.png 753w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-12-300x155.png 300w\" sizes=\"(max-width: 753px) 100vw, 753px\" \/><\/a><figcaption class=\"wp-element-caption\">Conexiones FCTDas con la base de datos local a trav\u00e9s de tcp\/1433.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-13.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"188\" src=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-13-1024x188.png\" alt=\"\" class=\"wp-image-3862\" srcset=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-13-1024x188.png 1024w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-13-300x55.png 300w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-13-768x141.png 768w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-13-830x152.png 830w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-13.png 1113w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption class=\"wp-element-caption\">Registros de FcmDaemon con detalles sobre las comunicaciones.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-14.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"196\" src=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-14-1024x196.png\" alt=\"\" class=\"wp-image-3863\" srcset=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-14-1024x196.png 1024w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-14-300x57.png 300w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-14-768x147.png 768w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-14-830x159.png 830w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-14.png 1244w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption class=\"wp-element-caption\">Uso de Windbg para examinar el formato del mensaje.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-15.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"409\" src=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-15-1024x409.png\" alt=\"\" class=\"wp-image-3864\" srcset=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-15-1024x409.png 1024w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-15-300x120.png 300w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-15-768x307.png 768w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-15-830x331.png 830w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-15.png 1192w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption class=\"wp-element-caption\">Consulta SQL en el registro DAS usando \u00a0script de Python.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-16.png\"><img loading=\"lazy\" decoding=\"async\" width=\"864\" height=\"173\" src=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-16.png\" alt=\"\" class=\"wp-image-3866\" srcset=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-16.png 864w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-16-300x60.png 300w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-16-768x154.png 768w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-16-830x166.png 830w\" sizes=\"(max-width: 864px) 100vw, 864px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CISA agreg\u00f3 CVE-2023-48788<\/strong>\u00a0a su cat\u00e1logo de vulnerabilidades explotadas conocidas (KEV) el lunes, instando a las organizaciones a instalar parches o implementar mitigaciones lo antes posible.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-17.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1019\" height=\"430\" src=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-17.png\" alt=\"\" class=\"wp-image-3867\" srcset=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-17.png 1019w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-17-300x127.png 300w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-17-768x324.png 768w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-17-830x350.png 830w\" sizes=\"(max-width: 1019px) 100vw, 1019px\" \/><\/a><figcaption class=\"wp-element-caption\"><a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2024\/03\/25\/cisa-adds-three-known-exploited-vulnerabilities-catalog\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.cisa.gov\/news-events\/alerts\/2024\/03\/25\/cisa-adds-three-known-exploited-vulnerabilities-catalog <\/a><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">No parece haber informaci\u00f3n disponible sobre los ataques que aprovechan CVE-2023-48788, pero las vulnerabilidades de los productos Fortinet a menudo han sido\u00a0<a href=\"https:\/\/www.securityweek.com\/chinese-hackers-exploited-fortinet-vpn-vulnerability-zero-day\/\" target=\"_blank\" rel=\"noreferrer noopener\">explotadas por actores de amenazas patrocinados por el estado<\/a>, como lo sucedido con los ataques realizados por China frente a la <strong>vulnerabilidad de d\u00eda cero de Fortinet VPN en 2023<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La Fundaci\u00f3n Shadowserver inform\u00f3 haber visto 130 sistemas aparentemente\u00a0<a href=\"https:\/\/twitter.com\/Shadowserver\/status\/1771963616092193085\" target=\"_blank\" rel=\"noreferrer noopener\">vulnerables<\/a>\u00a0a los que se hab\u00eda accedido directamente desde Internet hasta el 23 de marzo, incluidos 30 en los Estados Unidos.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">En el portal de <a href=\"https:\/\/www.cvedetails.com\/vendor\/3080\/Fortinet.html\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>www.cvedetails.com\/<\/strong><\/a> se reportan actualmente <strong>711 vulnerabilidades<\/strong> asociadas al fabricante Fortinet y en lo recorrido de 2024 se han detectado 12 vulnerabilidades <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-18.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"492\" src=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-18-1024x492.png\" alt=\"\" class=\"wp-image-3868\" srcset=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-18-1024x492.png 1024w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-18-300x144.png 300w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-18-768x369.png 768w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-18-830x399.png 830w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-18.png 1035w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption class=\"wp-element-caption\">https:\/\/www.cvedetails.com\/vendor\/3080\/Fortinet.html<\/figcaption><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>&gt;&gt; M\u00e1s detalles<\/strong>&nbsp;en nuestros canales privados de&nbsp;<mark><strong><a href=\"https:\/\/whatsapp.com\/channel\/0029VZzkzdhIXnltJlXVEA3J\" target=\"_blank\" rel=\"noreferrer noopener\">WhatsApp<\/a>&nbsp;<\/strong>y&nbsp;<a href=\"https:\/\/t.me\/itechsas\/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Telegram<\/strong><\/a>.<\/mark><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Es muy importante que se identifiquen las vulnerabilidades en los sistemas y aplicaciones antes que sean descubiertas por los actores maliciosos que aprovechan esas debilidades para realizar los ataques en b\u00fasqueda de beneficios econ\u00f3micos.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.itechsas.com\/blog\/ciberseguridad\/muchas-empresas-privadas-y-de-gobierno-afectadas-por-ciberataque-de-ransomware-masivo\/\" target=\"_blank\" rel=\"noreferrer noopener\">Muchas empresas privadas y de gobierno afectadas por ciberataque de ransomware masivo<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-8.png\"><img loading=\"lazy\" decoding=\"async\" width=\"529\" height=\"145\" src=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-8.png\" alt=\"\" class=\"wp-image-3845\" srcset=\"https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-8.png 529w, https:\/\/www.itechsas.com\/blog\/wp-content\/uploads\/2024\/04\/image-8-300x82.png 300w\" sizes=\"(max-width: 529px) 100vw, 529px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Recibe un&nbsp;<strong>Diagn\u00f3stico Sin Costo&nbsp;<\/strong>del estado de seguridad de tu aplicaci\u00f3n o sitio web dando clic en el siguiente enlace:<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link has-vivid-red-background-color has-background wp-element-button\" href=\"https:\/\/forms.gle\/5yvxp32NRbNSGQ5W9\" target=\"_blank\" rel=\"noreferrer noopener\">Reciba Diagnostico sin Costo<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>La agencia de ciberseguridad estadounidense -CISA- advierte a las empresas que una vulnerabilidad en el servidor de gesti\u00f3n empresarial (EMS) Fortinet FortiClient recientemente revelada como CVE-2023-48788 est\u00e1 siendo explotada en ataques. La vulnerabilidad que afecta a la soluci\u00f3n de gesti\u00f3n de endpoints empresariales (EMS FortiClient) se ha descrito como un\u00a0error cr\u00edtico de inyecci\u00f3n SQL valorado&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3872,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23],"tags":[433,432,357,434,91],"class_list":["post-3858","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ciberseguridad","tag-cve-2023-48788","tag-forticlient","tag-fortinet","tag-inyeccion-sql","tag-vulnerabilidad"],"nelio_content":{"autoShareEndMode":"never","automationSources":{"useCustomSentences":false,"customSentences":[]},"efiAlt":"","efiUrl":"","followers":[],"highlights":[],"isAutoShareEnabled":true,"networkImageIds":[],"permalinkQueryArgs":[],"series":[],"suggestedReferences":[]},"_links":{"self":[{"href":"https:\/\/www.itechsas.com\/blog\/wp-json\/wp\/v2\/posts\/3858","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.itechsas.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.itechsas.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.itechsas.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.itechsas.com\/blog\/wp-json\/wp\/v2\/comments?post=3858"}],"version-history":[{"count":10,"href":"https:\/\/www.itechsas.com\/blog\/wp-json\/wp\/v2\/posts\/3858\/revisions"}],"predecessor-version":[{"id":3879,"href":"https:\/\/www.itechsas.com\/blog\/wp-json\/wp\/v2\/posts\/3858\/revisions\/3879"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.itechsas.com\/blog\/wp-json\/wp\/v2\/media\/3872"}],"wp:attachment":[{"href":"https:\/\/www.itechsas.com\/blog\/wp-json\/wp\/v2\/media?parent=3858"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.itechsas.com\/blog\/wp-json\/wp\/v2\/categories?post=3858"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.itechsas.com\/blog\/wp-json\/wp\/v2\/tags?post=3858"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}