CVE-2022-40684 — FortiOS / FortiProxy / FortiSwitchManager Authentication Bypass (vamp-forticheck Scanner)
Published: 2026-07-31 • Researcher: belky-me (VampSecure Labs)
Exploitation signals
Confirmed exploited in the wild. Added to CISA KEV 2022-10-11. Federal remediation deadline 2022-11-01.
EPSS 100.0% · 100th percentile
- Severity
- Critical
- CVE
- CVE-2022-40684
- Category
- network
- Affected product
- Fortinet FortiOS (FortiGate firewalls), FortiProxy web proxy, FortiSwitchManager web management interface / administrative REST API
- Affected versions
- FortiOS 7.0.0–7.0.6 and 7.2.0–7.2.1; FortiProxy 7.0.0–7.0.6 and 7.2.0–7.2.1; FortiSwitchManager 7.2.0–7.2.1
- Disclosed
- 2026-07-31
- Patch status
- Unverified
Tags
References
Archive entry
intelseclab/poc-archiveOn this page
Metadata
| Field | Value |
|---|---|
| Date Added | 2026-07-31 |
| Last Updated | 2026-07-31 |
| Author / Researcher | belky-me (VampSecure Labs) |
| CVE / Advisory | CVE-2022-40684 |
| Category | network |
| Severity | Critical |
| CVSS Score | 9.8 (CVSSv3) |
| Status | Patched (FortiOS ≥7.2.2, ≥7.0.7; FortiProxy ≥7.2.1, ≥7.0.7; FortiSwitchManager ≥7.2.1) |
| Tags | fortios, fortiproxy, fortiswitchmanager, authentication-bypass, rest-api, header-injection, loopback-spoofing, fortigate, ssl-vpn, scanner |
| Related | N/A |
Affected Target
| Field | Value |
|---|---|
| Software / System | Fortinet FortiOS (FortiGate firewalls), FortiProxy web proxy, FortiSwitchManager web management interface / administrative REST API |
| Versions Affected | FortiOS 7.0.0–7.0.6 and 7.2.0–7.2.1; FortiProxy 7.0.0–7.0.6 and 7.2.0–7.2.1; FortiSwitchManager 7.2.0–7.2.1 |
| Language / Platform | Python 3 (AsyncIO/aiohttp scanner); target is embedded FortiOS on Fortinet network appliances |
| Authentication Required | No |
| Network Access Required | Yes — HTTPS access to the management interface / REST API |
Summary
CVE-2022-40684 is an authentication-bypass vulnerability in the web management interface of FortiOS, FortiProxy, and FortiSwitchManager that allows an unauthenticated remote attacker to access the administrative REST API. The affected firmware fails to validate certain HTTP headers and treats requests carrying a Forwarded: for="[127.0.0.1]" header as originating from the trusted loopback interface, skipping credential checks. It was exploited in the wild within days of disclosure in October 2022 (and was added to the CISA KEV catalog). The tool mirrored here — vamp_forticheck.py by belky-me (VampSecure Labs) — is an asynchronous multi-CVE scanner/audit tool that checks four critical Fortinet CVEs; its CVE-2022-40684 probe sends the spoofed Forwarded header with a User-Agent: Report Runner value to /api/v2/cmdb/system/admin and flags a host as vulnerable when the endpoint answers with an HTTP 200 admin-data payload without credentials.
Vulnerability Details
Root Cause
The FortiOS HTTP/HTTPS management daemon trusted the client-supplied Forwarded (or X-Forwarded-For) header when determining the origin of a request. By setting Forwarded: for="[127.0.0.1]" (optionally with by="[127.0.0.1]" and a host= reflecting the target hostname), an unauthenticated attacker could make the firmware believe the request originated from its own loopback interface. Because loopback-originated traffic was exempted from authentication middleware, the request was processed as if it came from an already-authenticated administrative context. The bug lives in the interface that proxies the administrative UI to the REST API, and the User-Agent: Report Runner value matches the value observed in the original in-the-wild exploitation and in Fortinet samples.
Attack Vector
An unauthenticated attacker sends an HTTPS request to the administrative REST API endpoint of an affected device, for example a GET to /api/v2/cmdb/system/admin, carrying the crafted headers:
Forwarded: for="[127.0.0.1]";by="[127.0.0.1]";host="<target-host>"
User-Agent: Report Runner
Content-Type: application/json
Accept: application/jsonNo credentials are required. The scanner in this folder sends a read-only probe so it can confirm the bypass without writing state; a real attacker could just as easily send state-changing requests (create an admin account, upload/modify an SSH key, change firewall policies).
Impact
Complete unauthenticated administrative control of the Fortinet device. An attacker can read and modify the full device configuration, add administrative accounts, install SSH keys for persistent access, disable or tamper with security controls, and use the perimeter device as a pivot point into the internal network. Because these devices typically sit at the network edge, the practical impact is a full network boundary compromise. CVE-2022-40684 was observed being actively exploited in the wild within days of the advisory and is listed in the CISA Known Exploited Vulnerabilities catalog.
Environment / Lab Setup
OS: Linux (any modern distro) with Python 3.9+
Target: FortiOS 7.0.0–7.0.6 or 7.2.0–7.2.1 (FortiGate), FortiProxy,
or FortiSwitchManager management interface exposed over HTTPS
Attacker: Attacker host running the scanner (network-reachable to the target)
Tools: vamp_forticheck.py (this folder), aiohttp, richSetup Steps
| |
Proof of Concept
See
vamp_forticheck.py(full, unmodified) andupstream-README.mdin this folder — mirrored from belky-me/vamp-forticheck. Verified before ingestion: the full 1403-line script was read end to end. It genuinely implements an async multi-CVE scanner with a working non-destructive CVE-2022-40684 probe, not a stub or dropper. This is an audit/scanner tool rather than a dedicated single-exploit PoC, so the proof of concept here is the tool’s built-in 40684 probe.
Step-by-Step Reproduction
Install dependencies — create a venv and install
aiohttpandrich(seerequirements.txt).Run the scanner against a single target:
Shell script1python3 vamp_forticheck.py https://<target-ip-or-host>Observe the 40684 probe result — the tool reports
VULNERABLEfor CVE-2022-40684 when the bypass probe succeeds. Internally the probe (inCVEChecker.check_cve_2022_40684) performs a GET to/api/v2/cmdb/system/adminwith the spoofedForwardedheader andUser-Agent: Report Runner, and confirms the bypass when it gets HTTP 200 with admin-configuration structure ("results","admin", or"status"in the body).Post-confirmation enumeration — if CVE-2022-40684 is confirmed, the tool’s
ExposureAnalyzerlists additional unauthenticated REST API endpoints reachable with the same bypass header (/api/v2/cmdb/system/interface,/api/v2/cmdb/vpn.ssl/settings,/api/v2/cmdb/user/local, etc.).
Exploit Code
The full implementation is in
vamp_forticheck.pyin this folder. The CVE-2022-40684 probe logic, minimally extracted:
| |
Expected Output
python3 vamp_forticheck.py https://192.0.2.10
[*] Objetivos: 1 · Concurrencia: 10 · Timeout: 10s
┌─ Resultados del Escaneo FortiOS ─────────────┐
│ Objetivo FortiOS Versión CVEs Confirm. Riesgo Score │
│ 192.0.2.10 SÍ 7.2.1 CVE-2022-40684 CRITICAL 9.8 │
└──────────────────────────────────────────────┘
⚠ HALLAZGOS CRÍTICOS
► CVE-2022-40684 CVSS 9.8
FortiOS/FortiProxy — bypass de autenticación mediante petición HTTP manipulada
Evidencia: HTTP 200 en /api/v2/cmdb/system/admin sin credenciales
Impacto: Acceso administrativo completo sin autenticaciónDetection & Indicators of Compromise
GET /api/v2/cmdb/system/admin HTTP/1.1
Host: <fortinet-device>
Forwarded: for="[127.0.0.1]";by="[127.0.0.1]";host="<fortinet-device>"
User-Agent: Report Runner
Accept: application/json- Unauthenticated HTTP 200 responses from any
/api/v2/*admin REST endpoint. - Requests carrying
Forwarded: for="[127.0.0.1]"and/orUser-Agent: Report Runner(the value seen in the original in-the-wild campaigns). - Sudden appearance of new admin accounts or new SSH keys on the device without a matching admin login event.
- FortiOS logs /
/var/logentries showing API access from external IPs without prior authentication.
SIEM / IDS Rule (example):
alert http any any -> any any (msg:"CVE-2022-40684 FortiOS auth bypass probe";
http_uri; content:"/api/v2/"; http_header; content:"Forwarded";
content:"127.0.0.1"; http_header; content:"User-Agent"; content:"Report Runner";
sid:90040684;)Remediation
| Action | Detail |
|---|---|
| Patch | Upgrade FortiOS to 7.0.7 or 7.2.2 (or later); FortiProxy to 7.0.7 or 7.2.2 (or later); FortiSwitchManager to 7.2.2 (or later). CVE-2022-40684 was patched by Fortinet in October 2022 (FG-IR-22-377). |
| Workaround | If an immediate upgrade is not possible, restrict access to the management interface: bind HTTPS administration to trusted source IPs only (no internet exposure), or block management-plane access at an upstream firewall. |
| Config Hardening | Disable the HTTP/HTTPS administrative interface on WAN-facing interfaces (config system interface / set allowaccess), enforce management over dedicated out-of-band or VPN-only channels, enable audit logging on the device, and monitor for the header signature above. |
References
Notes
Verified before ingestion this session: the upstream repository (https://github.com/belky-me/vamp-forticheck) was cloned directly (latest commit 59fb139 dated 2026-07-31, tagged in the commit message as v1.3) and its full contents read — vamp_forticheck.py (1403 lines), README.md, requirements.txt, and .gitignore. The script was confirmed to be a genuine, working asynchronous scanner rather than a stub, template, or phantom PoC: it implements a real CVE-2022-40684 probe (CVEChecker.check_cve_2022_40684) that sends the Forwarded: for="[127.0.0.1]" + User-Agent: Report Runner header bypass to /api/v2/cmdb/system/admin and confirms on HTTP 200 with admin data; a non-destructive CVE-2018-13379 path-traversal probe (against /lib/x86_64-linux-gnu/libssl.so.1.0.0 rather than the real credential file); version-range matching for CVE-2023-27997 (XORtigate) and CVE-2024-21762; a scope validator, risk-scoring model, and JSON/HTML report generators. The CVE set covered is CVE-2018-13379, CVE-2022-40684, CVE-2023-27997, and CVE-2024-21762 (note: some secondary references cite the 40684 tool as covering “CVE-2021-13379 / CVE-2018-27997 / CVE-2018-21762”, which are typo variants of the correct identifiers). The four files copied into this folder (vamp_forticheck.py, requirements.txt, .gitignore, upstream-README.md) are byte-for-byte identical to the upstream clone (verified via diff and md5sum); no paraphrasing or rewriting was performed.
This entry is filed under CVE-2022-40684 because that is the tool’s most impactful and the primary documented probe. The tool is an audit/scanner rather than a single dedicated exploit. Caveat on provenance: the author, belky-me (VampSecure Labs / VampSecure Studios), is a newer GitHub account (created 2026-04, 0 followers at review time); the code is genuine and self-consistent, but the author is unestablished, so treat this as a community scanner rather than an authoritative research artifact. The upstream repository declares MIT license in its README and publishes a requirements.txt (aiohttp, rich); no LICENSE file is present upstream, so none is mirrored here. As of this entry (2026-07-31), CVE-2022-40684 is patched in current FortiOS/FortiProxy/FortiSwitchManager releases but remains a high-value target because many edge devices are still unpatched; it was added to the CISA KEV catalog in 2022 due to confirmed in-the-wild exploitation.
| |