Fortinet FortiOS and FortiProxy Authentication Bypass and Remote Super-Admin Privilege Escalation (CVE-2024-55591)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-55591) is an Authentication Bypass Using an Alternate Path or Channel [CWE-288] in the administrative interface of FortiOS and FortiProxy. The root cause lies in how the internal Node.js WebSocket module processes incoming connection requests. Due to insufficient validation of the request path and headers, the system fails to enforce proper authentication checks, treating external requests as trusted internal communications.

2. Exploitation Mechanics & Attack Scenario

An attacker targets the exposed administrative interface (typically TCP port 443 or 10443) of a vulnerable Fortinet device. By sending a specially crafted HTTP Upgrade request designed to establish a WebSocket connection, the attacker exploits the alternate path vulnerability. This bypasses the standard authentication handshake, tricking the backend daemon into establishing an authenticated session with super-admin privileges without requiring any valid credentials.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an immediate threat to enterprise networks. Successful exploitation grants the attacker complete control over the firewall or proxy device. This allows them to alter security policies, intercept network traffic, extract VPN credentials, and pivot deeper into the internal corporate network, leading to catastrophic data breaches and operational downtime.