A out-of-bounds write in Fortinet FortiOS versions 7

CVE-2024-21762 is an out-of-bounds write in Fortinet sslvpnd, the SSL-VPN component used by FortiOS and FortiProxy. A remote attacker can send a specially crafted HTTP request using chunked transfer encoding and corrupt memory before authentication. Affected FortiOS trains are 7.4.0–7.4.2, 7.2.0–7.2.6, 7.0.0–7.0.13, 6.4.0–6.4.14, 6.2.0–6.2.15, and 6.0.0–6.0.17; affected FortiProxy trains are 7.4.0–7.4.2, 7.2.0–7.2.8, 7.0.0–7.0.14, and 2.0.0–2.0.13, with older 1.x branches requiring migration.

Vendor severity matches reality here. The only real friction is that the vulnerable SSL-VPN service must be reachable, but for the population that matters it is *supposed* to be internet-facing, exploitation was important enough for immediate KEV listing, public research showed reliable crash and code-exec paths, and internet scan data showed a very large exposed population.

Why this verdict

• No attacker foothold required: unauthenticated remote exploitation over HTTPS means there is no prior compromise stage to discount.
• Exposure model amplifies risk: SSL-VPN is commonly internet-facing by design, so the required attacker position is the public internet, not an internal segment or valid account.
• Threat intel supports the vendor number: KEV listing, rapid researcher weaponization, and large internet-exposed counts keep the practical risk aligned with the near-max CVSS.

Why not higher?

There is not much room above this. The only reason this is not a hypothetical 10.0 is that the vulnerable component is not universally enabled across every FortiGate or FortiProxy deployment, so population reach is somewhat narrower than a flaw in the base management plane with no feature dependency.

Why not lower?

Downgrading this because 'not every firewall exposes SSL-VPN' misses the point: the vulnerable population is exactly the population that tends to be exposed to the internet. This is also not an authenticated or post-initial-access bug, so the normal downward pressure from attacker-position friction simply is not there.

1. Disable SSL-VPN if you can — If business permits, turn off the exposed sslvpnd surface immediately; for this KEV-listed bug, deploy this within hours rather than waiting for the standard noisgate timeline.
2. Restrict source IPs to the VPN edge — If you cannot disable SSL-VPN, reduce reachable population with aggressive allowlisting, partner-only exposure, or upstream ACLs. For a live KEV issue, get this in place within hours as the minimum containment move.
3. Enable Fortinet's virtual patch signature — Use the vendor-provided virtual patch HTTP.Chunk.Length.Invalid. from FMWP DB update 24.020 to block malformed chunked requests targeting this parser path. Treat this as an emergency control and deploy within hours.
4. Hunt for appliance compromise — Review FortiGate/FortiProxy logs, admin changes, config access, and unexpected egress because exploitation evidence exists already. Start this triage within 3 days, and sooner for internet-facing gateways with heavy remote-access use.

Run this from an auditor workstation that can reach the FortiGate/FortiProxy HTTPS listener; do not run it on the appliance. Invoke it as python3 verify_cve_2024_21762.py https://vpn.example.com:443 with no special privileges required. It performs a safe behavioral check similar to the Bishop Fox technique: patched devices respond quickly, while vulnerable devices tend to hang waiting for more chunk data.

#!/usr/bin/env python3
"""
Safe behavioral verifier for CVE-2024-21762.
Usage: python3 verify_cve_2024_21762.py https://host:443
Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN
"""

import socket
import ssl
import sys
from urllib.parse import urlparse

TIMEOUT = 5.0


def parse_target(arg: str):
    if '://' not in arg:
        arg = 'https://' + arg
    u = urlparse(arg)
    if u.scheme != 'https' or not u.hostname:
        raise ValueError('Target must be an https URL or host[:port]')
    host = u.hostname
    port = u.port or 443
    return host, port


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN')
        sys.exit(2)

    try:
        host, port = parse_target(sys.argv[1])
    except Exception:
        print('UNKNOWN')
        sys.exit(2)

    payload = (
        f"POST /remote/ HTTP/1.1\r\n"
        f"Host: {host}\r\n"
        f"User-Agent: noisgate-cve-2024-21762-check/1.0\r\n"
        f"Transfer-Encoding: chunked\r\n"
        f"Connection: close\r\n"
        f"\r\n"
        f"0000000000000000FF\r\n"
        f"\r\n"
        f"abcd"
    ).encode()

    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    try:
        with socket.create_connection((host, port), timeout=TIMEOUT) as sock:
            with ctx.wrap_socket(sock, server_hostname=host) as tls:
                tls.settimeout(TIMEOUT)
                tls.sendall(payload)
                try:
                    data = tls.recv(1024)
                except socket.timeout:
                    # Vulnerable behavior: connection hangs waiting for more chunk data.
                    print('VULNERABLE')
                    sys.exit(1)

                if data:
                    # Patched behavior: parser rejects early and returns a response.
                    print('PATCHED')
                    sys.exit(0)
                else:
                    print('UNKNOWN')
                    sys.exit(2)
    except (ssl.SSLError, socket.error, OSError):
        print('UNKNOWN')
        sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Fortinet PSIRT FG-IR-24-015
2. NVD CVE-2024-21762
3. Assetnote exploit research
4. Bishop Fox safe scanner
5. GreyNoise research
6. Shadowserver vulnerable HTTP report
7. Shadowserver media coverage summary with exposure counts
8. Wiz vulnerability database entry