CVE-2024-55591 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Summary

[Update of 28 January 2025] A proof of concept enabling the exploitation of this vulnerability is publicly available. On 14 January 2025, Fortinet published a security advisory regarding the critical vulnerability CVE-2024-55591 affecting FortiOS and FortiProxy. It allows a remote unauthenticated attacker to bypass the authentication mechanism of the administration interface of a FortiOS or FortiProxy device and obtain super-administrator privileges by sending forged requests to the Node.js websocket module. The CERT-FR recalls that exposing an administration interface on the Internet is contrary to best practices. The CERT-FR therefore strongly recommends applying the patch as soon as possible. Fortinet indicates that this vulnerability is being actively exploited.

Recommendation

Refer to the vendor's security bulletin to obtain patches (see Documentation section). The vendor recommends the following workarounds: * disable the HTTP/HTTPS management interface; * restrict the IP addresses that can access the HTTP/HTTPS management interface; * create a local policy to restrict access to only the predefined group on the management interface. Refer to the vendor's security bulletin for details on the workaround measures. * perform a compromise search on the equipment; *Note: these indicators of compromise have not been qualified by CERT-FR.* * search for any signs of lateral movement across the rest of the information system, notably: * by looking for connections or connection attempts to the Internet from the equipment; * then by searching for these destination IP addresses to check if other machines have attempted a connection. * in case of detected compromise: * report the incident to CERT-FR, copying any relevant sectoral CSIRTs, and consult the best practices in case of intrusion on your information system [1]; * isolate the equipment from the network and back up the logs related to the equipment.

Summary

Multiple vulnerabilities have been discovered in Fortinet products. They allow an attacker to cause remote arbitrary code execution and a security policy bypass. Fortinet indicates that the CVE-2024-55591 vulnerability is actively exploited.

Recommendation

Refer to the vendor's security bulletin to obtain patches (see Documentation section).