CVE-2024-21762: Critical Fortinet FortiOS Out-of-Bound Write SSL VPN Vulnerability

Fortinet warns of “potentially” exploited flaw in the SSL VPN functionality of FortiOS, as government agencies warn of pre-positioning by Chinese state-sponsored threat actors in U.S. critical infrastructure through exploitation of known vulnerabilities

Background

On February 8, Fortinet published an advisory (FG-IR-24-015) to address a critical flaw in FortiOS, its network operating system.

Additionally, Fortinet patched three other vulnerabilities in FortiOS and FortiProxy, including a fix for the HTTP/2 Rapid Reset attack:

Analysis

CVE-2024-21762 is an out-of-bound write vulnerability in sslvpnd, the SSL VPN daemon in Fortinet FortiOS. An unauthenticated, remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to a vulnerable device that has SSL VPN enabled. Successful exploitation would allow an attacker remote code or command execution on the device.

Fortinet reports “potential” exploitation in the wild

In its advisory on February 8, Fortinet said this vulnerability is “potentially being exploited in the wild.” It has not shared any specifics about in-the-wild exploitation, nor has it shared any information about who reported the flaw as of February 9.

Historical exploitation of Fortinet FortiOS flaws

Fortinet devices, especially those with SSL VPN functionality enabled, have been a frequent target by attackers and we’ve written about several noteworthy Fortinet flaws since 2019:

Vulnerabilities in Fortinet devices have been exploited by multiple nation-state threat actors including an Iranian Islamic Revolutionary Guard Corps (IRGC) affiliated group, Russian state-sponsored threat actors, and ransomware groups like Conti and affiliates linked to other ransomware groups. Fortinet vulnerabilities have been included as part of the top routinely exploited vulnerabilities lists over the last few years ​​that have been published by the Cybersecurity and Infrastructure Security Agency (CISA) in partnership with other U.S. and international agencies.

On February 7, researchers at Fortinet published a blog post highlighting the exploitation of CVE-2022-42475 and CVE-2023-27997 by Chinese threat groups including Volt Typhoon, APT15 (also known as Ke3chang) and APT31 (also known as ZIRCONIUM) as well as UNC757 (also known as Fox Kitten), which has a “suspected nexus to the Iranian government.”

Dutch Authorities disclose that CVE-2022-42475 was abused to spread malware

On February 6, Dutch authorities released a cybersecurity advisory about an attack against the Netherlands Ministry of Defence (MOD) in which attackers exploited CVE-2022-42475 against a Fortigate device to gain initial access and deploy malware known as "COATHANGER." The report attributes the attack to PRC state-sponsored attackers and warns of the threat posed by known and exploitable vulnerabilities.

CISA, NSA and FBI warns of pre-positioning by Volt Typhoon in U.S. critical infrastructure

In addition to Fortinet’s blog post, a joint cybersecurity advisory (CSA) was published on February 7 (AA24-038A) by CISA, the National Security Agency (NSA) and Federal Bureau of Investigation (FBI) detailing the pre-positioning of the People’s Republic of China (PRC) state-sponsored threat actors including Volt Typhoon within critical infrastructure in the United States.

These agencies confirmed that multiple critical infrastructure organizations in Communications, Energy, Transportation Systems and Water and Wastewater Systems in the United States and territories like Guam have been compromised by Volt Typhoon.The CSA notes an example of one confirmed compromise that involved the exploitation of CVE-2022-42475 by Volt Typhoon against a vulnerable FortiGate 300D firewall that “was not patched.” Exploitation was corroborated through the analysis of the SSL VPN crash logs.

We cautioned about the threat posed by known vulnerabilities in SSL VPNs back in August 2021 in products from Fortinet, Ivanti (formerly Pulse Secure) and Citrix, as they provide attackers with the perfect doorway for exploitation. We strongly encourage organizations that use Fortinet devices with SSL VPN to upgrade to the latest fixed versions as soon as possible.

Proof of concept

At the time this blog post was published on February 9, no public proof-of-concept (PoC) exploit for CVE-2024-21762 was available.

Solution

Fortinet has released patches for several versions of FortiOS to address CVE-2024-21762:

If patching is not feasible at this time, organizations are advised to disable SSL VPN functionality until then. Fortinet’s advisory warns that simply disabling webmode is “NOT a valid workaround.”

Please note that the advisories for the remaining CVEs including CVE-2024-21762, CVE-2024-23113 and CVE-2023-44487 either list their own workaround options and the fixed releases or have fixed versions different from CVE-2024-21762. To ensure successful remediation of each of these vulnerabilities, we strongly recommend you upgrade to the latest available version of your current release branch.

Identifying affected systems

A list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2024-21762 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline. Additionally, product coverage for the other three CVEs patched by Fortinet can be seen on the individual CVE pages:

• CVE-2024-23113
• CVE-2023-44487
• CVE-2023-47537

Get more information

• Fortinet PSIRT Advisory for CVE-2024-21762 (FG-IR-24-015)
• Fortinet Blog: The Importance of Patching: An Analysis of the Exploitation of N-Day Vulnerabilities
• PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.