CVE-2024-21762

CVE-2024-21762: Fortinet FortiOS/FortiProxy Out-of-Bounds Write (CWE-787)

AI-generated analysis based on the vulnerability data on this page.

Summary

An out-of-bounds write vulnerability in Fortinet FortiOS and FortiProxy allows unauthenticated remote attackers to execute arbitrary code or commands via specifically crafted requests to the SSL VPN interface.

Background

Fortinet FortiOS is the operating system powering FortiGate next-generation firewalls, while FortiProxy provides secure web gateway capabilities. Both products are widely deployed at network perimeters worldwide. In February 2024, Fortinet disclosed a critical memory-safety vulnerability affecting the SSL VPN functionality in both product lines, which has since been actively exploited in the wild.

Root Cause

The vulnerability is classified as CWE-787 (Out-of-bounds Write). This occurs when software writes data past the end of an intended buffer. In FortiOS and FortiProxy's SSL VPN packet processing logic, insufficient bounds checking allows a specially crafted request to trigger a buffer overflow, enabling an attacker to overwrite adjacent memory regions and hijack execution flow.

Impact

With a CVSS 3.1 base score of 9.8 (Critical), this vulnerability is network exploitable with low attack complexity, requiring no privileges and no user interaction. The impact metrics are Confidentiality: HIGH, Integrity: HIGH, and Availability: HIGH. Successful exploitation grants an unauthenticated remote attacker the ability to execute unauthorized code or commands with the privileges of the SSL VPN service, effectively compromising the perimeter security device and enabling lateral movement into the protected network.

Exploitation Walkthrough

From a defensive perspective, exploitation involves an attacker sending malformed requests to an exposed SSL VPN interface (commonly TCP/443 or TCP/10443). The crafted requests exploit the bounds-checking deficiency to overwrite function pointers or other control structures in memory. Security teams should not attempt to reproduce this vulnerability in production environments. Instead, defenders should:

• Monitor SSL VPN endpoints for anomalous request patterns, including unexpected payload sizes and malformed TLS handshakes.
• Alert on repeated connection attempts from untrusted sources or unusual geolocations.
• Review Fortinet's Threat Intelligence for indicators of compromise (IoCs) associated with this campaign.

The existence of active exploitation has been confirmed by CISA and the EU Vulnerability Database (EUVD-2024-19376).

Affected and Patched Versions

Affected FortiOS versions:

• 6.0.0 through 6.0.17
• 6.2.0 through 6.2.15
• 6.4.0 through 6.4.14
• 7.0.0 through 7.0.13
• 7.2.0 through 7.2.6
• 7.4.0 through 7.4.2

Affected FortiProxy versions:

• 1.0.0 through 1.0.7
• 1.1.0 through 1.1.6
• 1.2.0 through 1.2.13
• 2.0.0 through 2.0.13
• 7.0.0 through 7.0.14
• 7.2.0 through 7.2.8
• 7.4.0 through 7.4.2

Specific patched versions were not provided in the source data; consult Fortinet PSIRT advisory FG-IR-24-015 for the exact upgrade paths.

Remediation

1. Upgrade immediately: Apply the latest patched firmware versions from Fortinet as specified in FG-IR-24-015.
2. Disable SSL VPN if unused: If the SSL VPN feature is not required, disable it to eliminate the attack surface entirely.
3. Restrict access: Limit SSL VPN portal access to trusted IP ranges via firewall rules or FortiGate local-in policies.
4. Enable MFA: Enforce multi-factor authentication for all VPN access as a compensating control (note: this does not block the vulnerability itself, but raises the bar for post-exploitation access).
5. Monitor: Review FortiGate logs for signs of compromise and conduct forensic analysis if exploitation is suspected.

Detection

• Monitor SSL VPN access logs for unusual connection patterns, repeated failed handshakes, or requests from unexpected geolocations.
• Deploy network intrusion detection systems (IDS) with signatures for known FortiOS SSL VPN exploitation attempts.
• Check for newly created local administrator accounts or unauthorized configuration changes on FortiGate devices.
• Review Fortinet's threat intelligence feeds for IoCs associated with CVE-2024-21762.

Assessment

This vulnerability carries an EPSS score of 0.83428, placing it in the 99.65th percentile of observed vulnerabilities, indicating a very high probability of active exploitation. It is listed in both the CISA Known Exploited Vulnerabilities (KEV) catalog and the EU Vulnerability Database (EUVD-2024-19376) as actively exploited since February 9, 2024. The combination of a critical CVSS score, network attack vector, no authentication requirement, and confirmed in-the-wild exploitation makes this a maximum-priority patching item.

Key lessons:

1. Memory-safety issues in perimeter-facing VPN services remain a primary attack vector for threat actors and demand rigorous input validation and secure coding practices.
2. Organizations must maintain accurate asset inventories of FortiOS/FortiProxy versions and have expedited patch procedures for critical, KEV-listed vulnerabilities.

References

• https://fortiguard.com/psirt/FG-IR-24-015
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21762