CVE-2024-55591: 
FortiOS vulnerability analysis and mitigation

An Authentication Bypass Using an Alternate Path or Channel vulnerability (CVE-2024-55591) was discovered affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy versions 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. The vulnerability was disclosed on January 14, 2025, and allows remote attackers to gain super-admin privileges through crafted requests to the Node.js websocket module. The vulnerability has been assigned a critical CVSS score of 9.8 (Fortinet Advisory).

The vulnerability (CWE-288) enables unauthenticated attackers to bypass authentication mechanisms by exploiting the Node.js websocket module through specially crafted requests. The flaw specifically affects the management interface of FortiOS and FortiProxy devices. The vulnerability received a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

Successful exploitation of this vulnerability allows attackers to gain super-admin privileges on affected systems. Observed attack patterns include creation of administrative accounts with random usernames, creation of local user accounts, modification of user groups including SSL VPN access, changes to firewall policies and addresses, and establishment of VPN tunnels to internal networks (Arctic Wolf, Fortinet Advisory).

Fortinet has released patches addressing this vulnerability: FortiOS users should upgrade to version 7.0.17 or above, FortiProxy 7.2.x users should upgrade to 7.2.13 or above, and FortiProxy 7.0.x users should upgrade to 7.0.20 or above. Alternative workarounds include disabling HTTP/HTTPS administrative interfaces or limiting access to the administrative interface through local-in policies. Organizations are also advised to implement non-standard and non-guessable usernames for admin accounts as an additional security measure (Fortinet Advisory).

The vulnerability was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on January 14, 2025, with a remediation deadline of January 21, 2025, highlighting the critical nature of this security issue. Security researchers from watchTowr were credited with discovering and responsibly disclosing the vulnerability (Censys, Arctic Wolf).