CVE-2024-21762 — FortiOS SSL VPN out-of-bounds write

CVE-2024-21762 — FortiOS SSL VPN out-of-bounds write

TL;DR: A pre-authentication out-of-bounds write in FortiOS’ SSL VPN web daemon (sslvpnd) allowed remote code execution against internet-facing FortiGate appliances. Disclosed February 2024; rapidly added to CISA KEV; mass-exploited within weeks. The bug lives in the parser for HTTP chunked transfer encoding inside the SSL VPN portal. Studied as a representative of the edge-appliance pre-auth chain class. Companion to cve-2024-3400-globalprotect-command-injection and cve-2024-21887-ivanti-connect-secure.

Why this matters as a study target

  • It’s a pre-auth RCE on perimeter SSL VPN — the highest-value class on the internet.
  • It exploits classic memory corruption in C code, not a logic flaw — useful for binary diff practice.
  • Fortinet patches go through clean version bumps and the appliance image is extractable — good for patched-binary-diffing-for-vulnid.
  • Public PoCs and writeups exist post-disclosure (watchTowr, Assetnote, others).

Vulnerable surface

sslvpnd is the daemon answering the HTTPS portal on the SSL VPN’s WAN interface. It handles:

  • Login pages, OTP, certificate auth.
  • POST forms with chunked encoding.
  • Proxy / RDP / SMB launchers.

The HTTP/1.1 parser supports chunked transfer encoding. The bug is in the size handling of a chunked body where a specific malformed chunk extension or length field caused a write past an allocated buffer.

The patch

Comparing the affected and patched images:

  • A new size check appears before the chunked-body memcpy.
  • An additional sanity check on the parsed length prevents the OOB length from feeding the copy.

That’s the seed: send a chunked POST with the size disagreement that beats the missing check.

Workflow for studying

  1. Pull both firmware images (vulnerable and fixed) — Fortinet’s customer support portal, or community mirrors for known-vulnerable versions.
  2. Extract sslvpnd from each image.
  3. BinDiff / Diaphora the two. The diff shows the new length-check.
  4. Trace upward in the patched binary to the request handler.
  5. Construct a POST request that produces the offending parser state.

See firmware-extraction for the unpack step.

Affected versions and impact

Fortinet’s advisory (FG-IR-24-015) lists:

  • FortiOS 7.4.0 through 7.4.2
  • FortiOS 7.2.0 through 7.2.6
  • FortiOS 7.0.0 through 7.0.13
  • FortiOS 6.4.0 through 6.4.14
  • FortiOS 6.2.0 through 6.2.15
  • FortiOS 6.0 (all 6.0 versions)

Pre-auth RCE on perimeter = full edge compromise. Recovery is “reimage and rotate every credential and key the appliance touched.”

Why operators kept getting hit

  • Edge appliance patching is slow. Many enterprises took weeks to apply.
  • Some operators don’t separate management from the WAN interface; the SSL VPN was exposed even on appliances not “used for VPN” yet.
  • Indicators of compromise specific to this CVE were limited — many backdoors deployed during the window remained after patching.
  • Web-shell persistence: attackers wrote files outside /data or registered new admin users; patching the binary didn’t remove either.

Detection and IR

For an org responding to a possible exploitation:

  • Compare current sslvpnd binary hash to a clean baseline.
  • Pull /var/log/log/ and search for sequence-anomaly POST patterns to the SSL VPN endpoint.
  • Inspect /data/etc/ and config sections for new admin users or unfamiliar SSO bindings.
  • Diff config against the last known-good backup.
  • Run Fortinet’s IoC scan tool (when published).

If compromise confirmed: factory reset → reimage → restore config selectively → rotate all secrets ever stored on the device (admin, RADIUS, SAML SP key, LDAP creds, IPSec PSKs).

Lessons

  • Chunked encoding parsers repeatedly produce OOB write bugs across products. Audit candidates: any web daemon with custom HTTP parsing (appliances, CDNs, embedded). See http-request-smuggling for the parser-differential angle.
  • Edge appliances need network segmentation. The management interface should not be reachable from the VPN-portal IP.
  • Out-of-band telemetry: vendor-managed telemetry would have surfaced anomalous crash patterns earlier.
  • CVE-2022-42475 (FortiOS SSL VPN, prior heap OOB write).
  • CVE-2023-27997 (Fortinet SSL VPN heap OOB).
  • The pattern repeats. Same parser code accumulates the same class of bugs.

References