Fortinet FortiOS/FortiProxy up to 7.0.16 Requests authentication bypass

Summaryinfo

A vulnerability was found in Fortinet FortiOS and FortiProxy up to 7.0.16. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Requests Handler. Performing a manipulation results in authentication bypass. This vulnerability is known as CVE-2024-55591. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

Detailsinfo

A vulnerability classified as very critical has been found in Fortinet FortiOS and FortiProxy up to 7.0.16. This affects an unknown code block of the component Requests Handler. The manipulation with an unknown input leads to a authentication bypass vulnerability. CWE is classifying the issue as CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

It is possible to read the advisory at fortiguard.fortinet.com. This vulnerability is uniquely identified as CVE-2024-55591 since 12/09/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but an exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/17/2025).

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 214072 (Fortinet Fortigate Authentication bypass in Node.js websocket module (FG-IR-24-535)), which helps to determine the existence of the flaw in a target environment. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 01/14/2025 with a due date of 01/21/2025:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Zero-Day.cz (948) and Tenable (214072). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Fortinet

Name

• FortiOS
• FortiProxy

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12
• 7.0.13
• 7.0.14
• 7.0.15
• 7.0.16

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion