CVE-2024-55591

A Fortinet FortiOS Authentication Bypass Vulnerable Behaviour Detection

Detection in Action

python CVE-2024-55591-check.py --target 192.168.1.10 --port 443
             __         ___  ___________                   
     __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________ 
     \ \/ \/ \__  \    ___/ ___\|  |  \\|    | /  _ \ \/ \/ \_  __ \
      \     / / __ \|  | \  \\___|   Y  |    |(  <_> \     / |  | \
       \/\_/ (____  |__|  \\\\___  |___|__|__  | \\__  / \\/\_/  |__|   
                  \\          \\     \\                              

        CVE-2024-55591.py
        (*) Fortinet FortiOS Authentication Bypass (CVE-2024-55591) vulnerable detection by watchTowr
        
          - Sonny , watchTowr (sonny@watchTowr.com)
          - Aliz Hammond, watchTowr (aliz@watchTowr.com)

        CVEs: [CVE-2024-55591]

[*] Targeting: https://192.168.1.10:443
[!] VULNERABLE: All conditions were met

Description

This script attempts to create a WebSocket connection at a random URI from a pre-authenticated perspective to the FortiOS management interface, and reviews the response to determine if the instance is vulnerable.

Affected Versions

• FortiOS 7.0.0 through 7.0.16
• FortiProxy 7.0.0 through 7.0.19
• FortiProxy 7.2.0 through 7.2.12

More details at Fortinet advisory

Note

This detection mechanism doesn't support FortiProxy.

Follow watchTowr Labs

For the latest security research follow the watchTowr Labs Team

• https://labs.watchtowr.com/
• https://x.com/watchtowrcyber