CVE-2024-55591
Fortinet FortiOS and FortiProxy — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Description
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2024-55591 scores CVSS 9.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and sits at the 99.9th EPSS percentile, reflecting both the trivial exploitation path and confirmed mass exploitation. Attackers abuse the Node.js websocket channel to bypass authentication entirely and obtain super-admin privileges, after which they typically create persistent backdoor accounts or configure rogue VPN tunnels — a pattern consistent with the CISA-confirmed ransomware campaign use flag. Organisations with FortiOS or FortiProxy management interfaces reachable from the internet are at immediate risk; this includes many KRITIS and NIS2-regulated operators who expose these interfaces for remote administration. Patch deployment should be treated as an emergency change; any organisation showing indicators of compromise must initiate incident notification to the relevant national authority (e.g. BSI in Germany) within 24 hours under NIS2 Article 23 obligations.
Runbook · Step 1
Immediate response (0-24 h)
- Apply the vendor patch immediately: Upgrade FortiOS to 7.0.17 or later and FortiProxy to 7.0.20 / 7.2.13 or later. Verify exact build availability in Fortinet advisory FG-IR-24-535 at support.fortinet.com before deployment.
- Isolate the management interface: Restrict TCP 443 and TCP 8443 on all FortiOS/FortiProxy admin interfaces to a dedicated management VLAN or out-of-band network — remove any direct internet exposure immediately.
- Audit active sessions and super-admin accounts: Run
get system session listanddiagnose sys session list; terminate any session originating from an unrecognised source IP. Enumerate all admin accounts and remove any that were not explicitly provisioned. - Rotate all local admin credentials and API tokens: Treat every local administrator password and API key on affected devices as compromised; rotate before re-enabling remote access.
- Diff the running configuration: Export the current config (
execute backup config) and compare it against the last known-good backup — focus on new admin accounts, VPN tunnels, and firewall policy changes. - Preserve forensic artefacts: Archive logs from
/var/log/and Node.js websocket logs before any reboot; retain timestamps for incident-response analysis.
Runbook · Step 2
Mitigation layers
- Network segmentation: Enforce an allowlist ACL or upstream firewall rule permitting TCP 443/8443 to the management interface only from known administrator source IPs; apply geo-blocking for regions with no operational need.
- WAF/IPS rule: Block or alert on WebSocket upgrade requests targeting the admin interface — Suricata rule:
alert http any any -> $MGMT_NET any (msg:"CVE-2024-55591 WS Auth Bypass attempt"; content:"Upgrade|3a 20|websocket"; http_header; content:"/api/"; http_uri; sid:2024055591; rev:1;). - Enforce MFA on all admin accounts: Enable FortiToken or RADIUS-based multi-factor authentication for every administrative login; this limits the blast radius even if the authentication bypass is partially triggered.
- Least-privilege admin profiles: Reduce existing admin profiles to the minimum required permissions; reserve the super-admin role for break-glass accounts that are not reachable remotely.
- VDOM isolation: If VDOMs are in use, confirm that the management VDOM has no routing path to production VDOMs, limiting post-compromise lateral movement.
Runbook · Step 3
Detection rules
- FortiOS event log — unexpected admin logins: Filter
type=event subtype=system action=login status=successfor source IPs not in the known admin allowlist:source_ip NOT IN [known_admin_ips] AND action="login" AND status="success". - SIEM — WebSocket anomaly on management port: Alert on WebSocket-upgraded connections to
/api/v2/or/remote/from external IPs without a valid prior session token; SPL:index=firewall sourcetype=fortigate action=accept dest_port IN (443,8443) uri_path="/api/v2/*" | where NOT src_ip IN (admin_allowlist). - New super-admin account creation: Sigma rule shape:
title: FortiOS New Super-Admin Account | logsource: product=fortigate | detection: keywords: ["action=add", "profile=super_admin"] | condition: all of them— trigger on any addition of a super-admin profile outside a change window. - Configuration changes outside change windows: Correlate
config_changeevents in the FortiOS audit log against CMDB change tickets; treat any unmatched change as a potential incident. - Post-compromise lateral movement: Monitor outbound connections from the FortiGate management IP to internal hosts on SMB (445), RDP (3389), or SSH (22) via Zeek
conn.log; these are strong indicators of hands-on-keyboard activity after a successful bypass.
Metrics
Weakness classes (CWE)
CWE-288Base
Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
cwe.mitre.org →
Affected operating systems
mobile
fortinet / fortios7.0.0
mobile
fortinet / fortios7.0.1
mobile
fortinet / fortios7.0.10
mobile
fortinet / fortios7.0.11
mobile
fortinet / fortios7.0.12
mobile
fortinet / fortios7.0.13
mobile
fortinet / fortios7.0.14
mobile
fortinet / fortios7.0.15
mobile
fortinet / fortios7.0.16
mobile
fortinet / fortios7.0.2
mobile
fortinet / fortios7.0.3
mobile
fortinet / fortios7.0.4
mobile
fortinet / fortios7.0.5
mobile
fortinet / fortios7.0.6
mobile
fortinet / fortios7.0.7
mobile
fortinet / fortios7.0.8
mobile
fortinet / fortios7.0.9
mobile
fortinet / fortios
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
fortinet
fortiproxy7.0.0 – 7.0.20
fortinet
fortiproxy7.2.0 – 7.2.13
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.