An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS…

CVE-2024-55591 is an unauthenticated auth bypass in the FortiOS/FortiProxy management plane. Fortinet says crafted requests to the Node.js websocket module can yield super_admin privileges; affected versions are FortiOS 7.0.0–7.0.16, FortiProxy 7.0.0–7.0.19, and FortiProxy 7.2.0–7.2.12, with fixes in FortiOS 7.0.17, FortiProxy 7.0.20, and FortiProxy 7.2.13.

The vendor's CRITICAL label matches reality once you focus on how these boxes are used: they sit on the perimeter, hold policy control, VPN access, and routing trust, and this bug has confirmed in-the-wild exploitation and KEV status. The only real downward pressure is that the management interface must be reachable, but that friction is not enough to move this out of CRITICAL because exposed admin planes were exactly what attackers targeted in observed campaigns.

Why this verdict

• Baseline stays near max: start from vendor/NVD criticality because the bug is AV:N/PR:N/UI:N on a perimeter device, not a niche internal service.
• One real friction lowers it slightly: exploitation generally requires the HTTP/HTTPS administrative interface to be reachable, which narrows the exposed population versus 'every FortiGate on the internet.'
• That discount gets erased by field evidence: CISA KEV on 2025-01-14, Fortinet-confirmed exploitation, and Arctic Wolf's pre-disclosure campaign reporting show attackers were already doing exactly this against exposed admin planes.
• Blast radius is exceptional: super_admin on a firewall/VPN appliance means policy tampering, credential or config theft, rogue VPN access, and a clean path to internal-network pivoting.

Why not higher?

There is no higher bucket than CRITICAL, and this is close to the top of that range already. The one thing keeping it from a perfect 10 is that the attack path is not universal across all deployments; organizations that never expose the admin interface have materially less reachability.

Why not lower?

Downgrading this would ignore the two facts that matter most: active exploitation and initial-access utility on a perimeter choke point. This is not a post-compromise local bug, not an authenticated admin edge case, and not a narrow feature toggle affecting an obscure subset.

1. Remove public admin exposure — Take the HTTP/HTTPS administrative interface off the public internet or pin it to explicit management-source IPs immediately, within hours because KEV/active exploitation overrides the normal timeline. This directly breaks step 1 of the attack chain and is Fortinet's preferred workaround.
2. Apply restrictive local-in policy — If public removal is not immediately possible, restrict GUI access with Fortinet local-in-policy controls immediately, within hours so only jump hosts or admin networks can reach it. Fortinet explicitly prefers local-in policies over relying on trusthost alone.
3. Disable Security Fabric if exposed and unpatched — For the CSF request variant described in Fortinet's advisory, disable Security Fabric from the CLI immediately, within hours if you cannot patch at once. This is a temporary blast-radius reduction, not a substitute for upgrading.
4. Hunt for appliance persistence — Review Fortinet logs and configs for ui="jsconsole", Local_Process_Access, random admin creation, local user creation, SSL VPN group changes, and unexpected firewall policy edits immediately, within hours. Active exploitation means exposure may already equal compromise.
5. Freeze new VPN/admin objects — Alert on or require review for any new local users, admin accounts, and SSL VPN group membership changes immediately, within hours. Fortinet and Arctic Wolf both observed attackers using those exact persistence patterns.

Run this from an auditor workstation that can reach the target's HTTPS management interface; invoke it exactly as python3 fortios_cve_2024_55591_check.py 10.0.0.1 443. It needs only network access to the admin port and does not require credentials or privileged local access; it performs a lightweight pre-auth websocket behavior check and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# CVE-2024-55591 pre-auth websocket behavior check
# Usage: python3 fortios_cve_2024_55591_check.py <host> [port]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE

import base64
import os
import random
import socket
import ssl
import sys

TIMEOUT = 7


def build_request(host, path):
    key = base64.b64encode(os.urandom(16)).decode()
    headers = [
        f"GET {path} HTTP/1.1",
        f"Host: {host}",
        "User-Agent: noisgate-cve-2024-55591-check/1.0",
        "Upgrade: websocket",
        "Connection: Upgrade",
        f"Sec-WebSocket-Key: {key}",
        "Sec-WebSocket-Version: 13",
        "Origin: https://%s" % host,
        "\r\n",
    ]
    return "\r\n".join(headers).encode()


def recv_some(sock):
    data = b""
    try:
        while True:
            chunk = sock.recv(4096)
            if not chunk:
                break
            data += chunk
            if b"\r\n\r\n" in data:
                break
    except socket.timeout:
        pass
    return data


def main():
    if len(sys.argv) not in (2, 3):
        print("UNKNOWN")
        print("Usage: python3 fortios_cve_2024_55591_check.py <host> [port]", file=sys.stderr)
        sys.exit(3)

    host = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) == 3 else 443

    # Use a few candidate paths because deployed behavior can vary by build.
    candidates = [
        "/ws/events",
        "/ws/cli/open",
        "/ws/%d" % random.randint(10000, 99999),
    ]

    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    saw_rejection = False
    errors = []

    for path in candidates:
        try:
            raw = socket.create_connection((host, port), timeout=TIMEOUT)
            raw.settimeout(TIMEOUT)
            tls = ctx.wrap_socket(raw, server_hostname=host)
            req = build_request(host, path)
            tls.sendall(req)
            resp = recv_some(tls)
            tls.close()

            head = resp.decode(errors="ignore")
            if "101 Switching Protocols" in head:
                print("VULNERABLE")
                sys.exit(1)
            if any(code in head for code in ["401 Unauthorized", "403 Forbidden", "404 Not Found", "400 Bad Request"]):
                saw_rejection = True
                continue
            errors.append(f"{path}: unexpected response: {head[:120]!r}")
        except Exception as e:
            errors.append(f"{path}: {e}")

    if saw_rejection:
        print("PATCHED")
        sys.exit(0)

    print("UNKNOWN")
    if errors:
        print("; ".join(errors[:3]), file=sys.stderr)
    sys.exit(2)


if __name__ == "__main__":
    main()

Sources

1. Fortinet PSIRT FG-IR-24-535
2. NVD CVE-2024-55591
3. CISA KEV alert adding CVE-2024-55591
4. Arctic Wolf follow-up on CVE-2024-55591
5. Arctic Wolf Console Chaos campaign analysis
6. watchTowr technical analysis
7. Censys advisory and exposure data
8. watchTowr detection script repository