FortiOS SSL-VPN Out-of-Bounds Write RCE
- Product
- Fortinet FortiOS / FortiProxy SSL-VPN
- CVE
- CVE-2024-21762
- Disclosed
- 2024-02-08
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- FortiOS 7.4.0-7.4.2, 7.2.0-7.2.6, 7.0.0-7.0.13, 6.4.0-6.4.14, 6.2.0-6.2.15, 6.0 all; FortiProxy 7.4.0-7.4.2, 7.2.0-7.2.8, 7.0.0-7.0.14, 2.0, 1.x.
- Fixed
- FortiOS 7.4.3, 7.2.7, 7.0.14, 6.4.15, 6.2.16; FortiProxy 7.4.3, 7.2.9, 7.0.15, 2.0.14.
Summary
An out-of-bounds write in the FortiOS SSL-VPN daemon allowed unauthenticated remote code execution via crafted HTTP requests. Fortinet flagged it as potentially exploited in the wild and CISA added it to KEV the next day.
Root cause
sslvpnd's handling of HTTP chunked transfer encoding miscomputed buffer bounds when processing chunk lengths, allowing a small out-of-bounds write on the stack. Assetnote showed that even this two-byte write could be leveraged into full code execution.
Impact
Unauthenticated code execution on the firewall.
Detection
Version-check FortiOS; Assetnote and BishopFox published checkers that test the chunked-encoding behaviour non-destructively.
Mitigation
Upgrade or disable SSL-VPN (disabling web mode alone is insufficient).