Fortinet warns of “potentially” exploited flaw in the SSL VPN functionality of FortiOS, as government agencies warn of pre-positioning by Chinese state-sponsored threat actors in U.S. critical infrastructure through exploitation of known vulnerabilities

CVE-2024-21762: Critical Fortinet FortiOS Out-of-Bound Write SSL VPN Vulnerability

A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests

Researchers have found nearly 150,000 publicly accessible devices vulnerable to this flaw. Organizations that haven't patched are strongly advised to do so.

Historical widespread exploitation of vulnerabilities in the SSL VPN component of FortiOS makes patching this a priority. If not, disable SSL VPN until upgrade is possible.

FortiOS version 6.0.x prior to 6.0.16 or 6.2.x prior to 6.2.15 or 6.4.x prior to 6.4.14 or 7.0.x prior to 7.0.13 or 7.2.x prior to 7.2.6 or 7.4.x prior to 7.4.2 and FortiProxy version 7.0.x prior to 7.0.14 or 7.2.x prior to 7.2.8 or 7.4.x prior to 7.4.2 are affected by a vulnerability allowing allows a remote attacker to execute arbitrary code or command through a specially crafted request.

The instance of Fortinet FortiOS or Fortinet FortiProxy running on the remote host is affected by a remote code execution vulnerability:

  - A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13,     6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0     through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through     1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests. (CVE-2024-21762)

The version of FortiProxy installed on the remote host affected by an out-of-bounds write vulnerability in sslvpnd that can allow an attacker to execute unauthorized code or commands via specifically crafted requests.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-015 advisory.

  - A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through     7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0     through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13,     1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via     specifically crafted requests (CVE-2024-21762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114795	FortiOS 7.0.x < 7.0.13 / 7.2.x < 7.2.6 / 7.4.x < 7.4.2 Remote Code Execution	Web App Scanning	Component Vulnerability	critical
236788	Fortinet FortiOS and FortiProxy Remote Code Execution (CVE-2024-21762)	Nessus	CGI abuses	critical
191084	Fortinet FortiProxy Out-of-bound Write in sslvpnd (FG-IR-24-015)	Nessus	Firewalls	critical
190238	Fortinet Fortigate Out-of-bound Write in sslvpnd (FG-IR-24-015)	Nessus	Firewalls	critical

Detections

Analytics

CVE-2024-21762

critical

Tenable Plugins

critical

critical

critical

critical