CVE-2024-55591

The vulnerability results from the ability to bypass the authentication mechanism through an alternative path or communication channel (CWE-288). The attacker sends specially crafted requests to the Node.js websocket module embedded in the device, which allows bypassing standard identity verification. As a result, the attacker gains access with super-admin privilege level without needing to provide any credentials.

A remote attacker, without any authentication, can obtain full super-administrator privileges on the device, enabling complete takeover of the firewall or proxy, modification of network configuration, and potential lateral movement within the protected infrastructure.

FortiOS should be updated as soon as possible to version 7.0.16 or higher, and FortiProxy to version 7.0.19 or higher (7.0.x branch) or 7.2.12 or higher (7.2.x branch). Detailed information on available patches is available in the vendor's security bulletin: https://fortiguard.fortinet.com/psirt/FG-IR-24-535

FortiOS in versions 7.0.0 – 7.0.16 and FortiProxy in versions 7.0.0 – 7.0.19 and 7.2.0 – 7.2.12

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.