Unpacking Active Fortinet Exploits — What You Need

Attackers actively target Fortinet devices, especially their SSL VPN components, to gain initial access to networks. Recent critical vulnerabilities, such as CVE-2024-21762 and CVE-2023-27997, highlight the ongoing threat posed by actively exploited Fortinet products. These flaws allow unauthenticated, remote attackers to execute arbitrary code, bypassing traditional security controls like multi-factor authentication (MFA). Organizations must prioritize patching and robust monitoring to defend against these persistent threats.

Actively Exploited Fortinet: CVE-2024-21762

What the Vulnerability Is and Its Impact

CVE-2024-21762 is a critical out-of-bounds write vulnerability affecting Fortinet FortiOS. This flaw resides in the sslvpnd daemon, which manages SSL VPN functionalities. It carries a CVSSv3 score of 9.6 or 9.8, categorizing it as critical.

The vulnerability allows a remote, unauthenticated attacker to execute arbitrary code or commands on the affected device. This grants the attacker full control with root privileges, compromising the security appliance. CISA added CVE-2024-21762 to its Known Exploited Vulnerabilities (KEV) catalog shortly after disclosure, confirming active exploitation in the wild.

Affected FortiOS versions include: 7.4.0 through 7.4.2 (fixed in 7.4.3 or above), 7.2.0 through 7.2.6 (fixed in 7.2.7 or above), 7.0.0 through 7.0.13 (fixed in 7.0.14 or above), 6.4.0 through 6.4.14 (fixed in 6.4.15 or above), and 6.2.0 through 6.2.15 (fixed in 6.2.16 or above). FortiProxy versions are also impacted.

Technical Root Cause Analysis

The root cause of CVE-2024-21762 is an improper bounds check within the sslvpnd daemon. Specifically, the flaw exists in how the daemon handles certain HTTP request data, particularly with chunked transfer encoding.

Attackers can craft a malicious HTTP request where a chunk size is manipulated. This manipulation causes the system to write data beyond the intended buffer's boundaries in memory. This memory corruption can then be leveraged for arbitrary code execution.

Exploitation Mechanics

Exploitation of CVE-2024-21762 is pre-authentication, meaning an attacker does not need valid credentials. Attackers send specially crafted HTTP POST requests to the SSL VPN interface. Even requests to invalid paths under /remote/ can trigger the vulnerable function.

The manipulated chunked transfer encoding within the HTTP request leads to the out-of-bounds write. This allows an attacker to control memory and redirect the process flow, ultimately achieving remote code execution with root privileges. This provides a direct path for initial access into target networks.

Detection

Organizations should review FortiGate logs for unusual sslvpnd crashes or restarts. Look for suspicious connections to the SSL VPN interface from unexpected IP addresses. Indicators of Compromise (IoCs) include unexpected network traffic patterns, unusual process execution, or memory corruption errors in logs.

Utilize network monitoring tools to detect abnormal traffic. Host Intrusion Detection Systems (HIDS) can observe unauthorized code execution activities. A free port scanner can identify exposed FortiGate SSL VPN ports, which attackers often target. Zondex can assist with internet-wide scanning to discover exposed FortiGate instances on your attack surface.

Bishop Fox developed a method to test for patched firmware by observing behavioral changes in response times to specific chunked POST requests. This technique differentiates between vulnerable and patched devices without crashing the service.

Remediation Steps

Patch immediately to the recommended fixed versions of FortiOS. Fortinet strongly advises upgrading to the latest available version of your current release branch.

If immediate patching is not feasible, disable SSL VPN functionality. Fortinet warns that simply disabling web mode is not a sufficient workaround.

Implement strong multi-factor authentication (MFA) for all remote access. Isolate SSL VPN access to trusted IP ranges where possible. Regularly review FortiGate logs for any signs of compromise or unusual activity.

Timeline of Disclosure

Fortinet disclosed CVE-2024-21762 on February 8, 2024, in security advisory FG-IR-24-015. CISA added it to its Known Exploited Vulnerabilities catalog on the same day, confirming active exploitation.

Public awareness and technical analysis followed quickly, emphasizing the immediate risk. This rapid timeline underscores the severity and active threat this vulnerability posed to organizations globally.

Actively Exploited Fortinet: CVE-2023-27997

What the Vulnerability Is and Its Impact

CVE-2023-27997 is a critical heap-based buffer overflow vulnerability affecting Fortinet FortiOS and FortiProxy devices. This flaw exists in the SSL-VPN web portal and received a CVSS score of 9.8 (Critical).

The vulnerability allows an unauthenticated, remote attacker to execute arbitrary code or commands on the device. This bypasses security controls like MFA, making it an extremely dangerous entry point for attackers.

Affected FortiOS versions include: 7.2.0 through 7.2.4 (upgrade to 7.2.5 or above), 7.0.0 through 7.0.11 (upgrade to 7.0.12 or above), 6.4.0 through 6.4.12 (upgrade to 6.4.13 or above), and 6.2.0 through 6.2.13 (upgrade to 6.2.14 or above). FortiProxy versions are also affected.

Technical Root Cause Analysis

The vulnerability resides in how the SSL-VPN portal processes specific HTTP parameters, particularly within the /remote/hostcheck_validate and /remote/logincheck endpoints. The root cause is a heap-based buffer overflow triggered by an incorrect length check when decoding the enc parameter.

The application allocates a buffer based on the input size but fails to validate the payload length correctly. This truncation error, where the length is stored in an 8-bit variable instead of a larger type, allows an attacker to provide a payload length that appears valid but exceeds the allocated buffer. This leads to an out-of-bounds write on the heap.

Exploitation Mechanics

Attackers exploit CVE-2023-27997 by sending malicious HTTP GET or POST requests containing crafted enc parameters to the SSL-VPN interface. This triggers the heap-based buffer overflow pre-authentication.

By manipulating the heap layout, attackers overwrite critical memory structures like function pointers. This hijacking of execution flow grants control of the device. Post-exploitation, attackers often deploy lightweight binaries, install webshells, or steal configuration files to establish persistence and move laterally.

Detection

Monitor FortiGate devices for signs of exploitation. Check logs for unusual process activity, unexpected file modifications, or new user accounts. FortiGuard IPS signatures can help detect exploitation attempts.

Sophisticated detection methods involve analyzing response times to crafted requests. By comparing response times for requests with valid and invalid length fields, security practitioners can infer if the sslvpnd is processing data with an incorrect length, indicating vulnerability.

Use a free website vulnerability scanner for general web application posture, and check HTTP security headers with Secably's HTTP security headers checker to identify broader web security weaknesses that might be present alongside these critical vulnerabilities.

Remediation Steps

Upgrade FortiOS and FortiProxy devices to the patched versions immediately. Fortinet released advisory FG-IR-23-097 with patches on June 12, 2023.

If upgrading is not possible, disable SSL-VPN functionality. This mitigates the risk, but Fortinet still recommends upgrading all devices.

Review systems for evidence of previous vulnerability exploitation, such as CVE-2022-42475, which also targets the SSL-VPN interface and has been actively exploited. Maintain good cyber hygiene and follow vendor hardening recommendations.

Timeline of Disclosure

Security researchers Charles Fol and Dany Bach from Lexfo discovered CVE-2023-27997. They responsibly disclosed it to Fortinet. Fortinet released security advisory FG-IR-23-097 and patches on June 12, 2023.

Public disclosure and technical details followed, with reports indicating limited exploitation prior to the public release. CISA also released an alert encouraging users to apply updates.

General Fortinet Security Best Practices

Regularly apply security patches and updates to all Fortinet devices. Many threat actors exploit known, unpatched vulnerabilities shortly after disclosure. This reduces attack surface significantly.

Implement network segmentation to limit the impact of a potential breach. Configure strict firewall rules and ensure the principle of least privilege is enforced across the environment. Review how Unpacking Critical RCE Vulnerabilities (CVEs) can affect your infrastructure.

Use multi-factor authentication (MFA) for all administrative interfaces and remote access services, even if some pre-authentication vulnerabilities exist. This adds a layer of defense against credential compromise. Reduce your attack surface by disabling unused features and managing devices via an out-of-band method wherever possible.