CVE-2024-32115
📋 TL;DR
A relative path traversal vulnerability in Fortinet FortiManager allows privileged attackers to delete files from the underlying filesystem via crafted HTTP/HTTPS requests. This affects FortiManager versions 7.4.0 through 7.4.2 and versions before 7.2.5.
💻 Affected Systems
- Fortinet FortiManager
📦 What is this software?
Fortimanager by Fortinet
Fortimanager by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Privileged attacker could delete critical system files, causing service disruption, data loss, or complete system compromise.
Likely Case
Privileged attacker deletes configuration files or logs, disrupting management operations and hindering forensic investigation.
If Mitigated
With proper access controls and network segmentation, impact is limited to authorized management interfaces only.
🎯 Exploit Status
Exploitation requires authenticated privileged access but uses simple path traversal techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.4.3 or 7.2.5 and later
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-24-097
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download and install FortiManager version 7.4.3 or 7.2.5 from Fortinet support portal. 3. Apply the update through the web interface or CLI. 4. Reboot the system as required.
🔧 Temporary Workarounds
Restrict Management Access
allLimit access to FortiManager management interface to trusted IP addresses only.
config system interface
edit <interface_name>
set allowaccess https ssh ping
set trust-ip-1 <trusted_ip>
end
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FortiManager from untrusted networks.
- Enforce least privilege access controls and monitor privileged user activities.
🔍 How to Verify
Check if Vulnerable:
Check FortiManager version via web interface (System > Dashboard) or CLI command: get system statusCheck Version:
get system status | grep VersionVerify Fix Applied:
Verify version is 7.4.3 or higher, or 7.2.5 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in system logs
- Multiple failed path traversal attempts in web logs
Network Indicators:
- HTTP/HTTPS requests with '../' patterns to FortiManager management interface
SIEM Query:
source="fortimanager" AND (url="*../*" OR action="delete")