CVE-2024-21762

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 7.4.0 through 7.4.2 Fortinet FortiOS versions 7.2.0 through 7.2.6 Fortinet FortiOS versions 7.0.0 through 7.0.13 Fortinet FortiOS versions 6.4.0 through 6.4.14 Fortinet FortiOS versions 6.2.0 through 6.2.15 Fortinet FortiOS versions 6.0.0 through 6.0.17 FortiProxy versions 7.4.0 through 7.4.2 FortiProxy versions 7.2.0 through 7.2.8 FortiProxy versions 7.0.0 through 7.0.14 FortiProxy versions 2.0.0 through 2.0.13 FortiProxy versions 1.2.0 through 1.2.13 FortiProxy versions 1.1.0 through 1.1.6 FortiProxy versions 1.0.0 through 1.0.7

Description An out-of-bounds write (a condition where data is written outside the intended memory buffer) in the sslvpnd service allows a remote unauthenticated attacker to execute unauthorized code or commands. This is achieved by sending specifically crafted HTTP requests. Real-world incidents of this issue being exploited have been recorded, including exploitation chains that fingerprint the target device to select specific shellcode and exfiltrate configuration files from the /data/config/ directory.

Recommendations As a temporary workaround, disable SSL VPN for all affected versions of FortiOS and FortiProxy. Note that disabling webmode is not a valid mitigation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.