CVE-2024-23663
📋 TL;DR
This vulnerability allows attackers to create users with elevated privileges on Fortinet FortiExtender devices via crafted HTTP requests. It affects multiple versions of FortiExtender firmware. Organizations using affected versions are at risk of unauthorized administrative access.
💻 Affected Systems
- Fortinet FortiExtender
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise leading to network infiltration, data exfiltration, and use as pivot point for lateral movement.
Likely Case
Unauthorized administrative access allowing configuration changes, network monitoring, and credential harvesting.
If Mitigated
Limited impact due to network segmentation and strict access controls preventing exploitation attempts.
🎯 Exploit Status
Requires network access to the FortiExtender management interface. Crafted HTTP request needed but no authentication required for the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions 7.4.3, 7.2.5, 7.0.5, 5.3.3, 4.2.7, and 4.1.10
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-23-459
Restart Required: Yes
Instructions:
1. Download appropriate firmware version from Fortinet support portal. 2. Backup current configuration. 3. Upload firmware via web interface or CLI. 4. Reboot device after installation.
🔧 Temporary Workarounds
Restrict Management Access
allLimit access to FortiExtender management interface to trusted IP addresses only
config system interface
edit <interface_name>
set allowaccess https ssh
set trust-ip-1 <trusted_ip>
end
Disable Unused Services
allDisable HTTP/HTTPS management if not required for operations
config system interface
edit <interface_name>
set allowaccess ssh
end
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FortiExtender devices
- Enable detailed logging and monitor for unauthorized user creation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > Dashboard) or CLI command: get system statusCheck Version:
get system status | grep VersionVerify Fix Applied:
Verify firmware version is updated to patched version and test user creation functionality📡 Detection & Monitoring
Log Indicators:
- Unexpected user creation events
- HTTP requests to user management endpoints from unauthorized sources
- Failed authentication attempts followed by successful user creation
Network Indicators:
- HTTP POST requests to /api/v2/cmdb/system/admin/user with privilege escalation parameters
- Unusual traffic patterns to FortiExtender management interface
SIEM Query:
source="fortiextender" AND (event_type="user_creation" OR uri_path="/api/v2/cmdb/system/admin/user")