Fortinet FortiOS SSL-VPN Out-of-Bounds Write Remote Code Execution

Advisory Breakdown

CVE-2024-21762 is a critical out-of-bounds write vulnerability (CWE-787) in the Fortinet FortiOS SSL-VPN web portal (sslvpnd). Assigned a CVSSv3 score of 9.8 (CRITICAL), the vulnerability allows an unauthenticated external attacker to execute arbitrary code or commands on the underlying FortiGate appliance via specially crafted HTTP requests.

Fortinet confirmed that this vulnerability was actively exploited in the wild prior to disclosure as a zero-day against government, military, and corporate perimeter devices.

Root Cause: Chunked Transfer Encoding Flaw

The vulnerability exists within the HTTP request parsing engine of sslvpnd. When an incoming request specifies Transfer-Encoding: chunked, the web server parses hexadecimal chunk lengths followed by data blocks.

POST /remote/login HTTP/1.1
Host: vpn.enterprise.corp
Transfer-Encoding: chunked
Content-Type: application/x-www-form-urlencoded

0


[Malformed chunk parameters triggering integer conversion error]

During length calculation, a signed integer comparison flaw exists when converting chunk parameters into internal buffer allocations. By supplying an unexpected combination of chunk sizes and delimiters, an attacker can manipulate the internal write offset pointer.

When sslvpnd writes chunk contents into the heap buffer, it calculates the remaining buffer capacity incorrectly, allowing bytes to be written past the boundaries of the allocated heap chunk.

Impact & Exploitation Dynamics

• •
  Unauthenticated Access: The vulnerable parser runs on the public SSL-VPN listening port (default TCP 443 or TCP 10443) before any session authentication or multi-factor authentication (MFA) occurs.
• •
  Memory Corruption: Overwriting adjacent heap structures allows hijacking function pointers inside the sslvpnd process.
• •
  Appliance Takeover: Successful exploitation yields root privileges inside the FortiOS restricted shell, enabling attackers to extract active VPN session cookies, decrypt enterprise traffic, or pivot internally into corporate networks.

Remediation & Mitigations

• •
  FortiOS 7.4.3 or higher
• •
  FortiOS 7.2.7 or higher
• •
  FortiOS 7.0.14 or higher
• •
  FortiOS 6.4.15 or higher

Completely disable the SSL-VPN web portal by executing:

config vpn ssl settings
set status disable
   end

*Note: Merely disabling the web mode while keeping tunnel mode enabled does NOT mitigate the vulnerability.*