CVE-2024-36513
📋 TL;DR
This vulnerability in FortiClient for Windows allows authenticated users to escalate privileges through Lua auto patch scripts. It affects FortiClient Windows versions 7.2.4 and below, 7.0.12 and below, and all 6.4 versions. Attackers with local access can gain SYSTEM-level privileges.
💻 Affected Systems
- FortiClient for Windows
📦 What is this software?
Forticlient by Fortinet
Forticlient by Fortinet
Forticlient by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker gains SYSTEM privileges, enabling complete system compromise, installation of persistent malware, credential theft, and lateral movement across the network.
Likely Case
Malicious insider or compromised user account escalates to SYSTEM privileges to install backdoors, disable security controls, or access sensitive data.
If Mitigated
With proper access controls and monitoring, impact is limited to isolated systems with rapid detection and containment.
🎯 Exploit Status
Exploitation requires authenticated access but appears straightforward based on vulnerability description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiClient 7.2.5, 7.0.13, and later versions
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-24-144
Restart Required: Yes
Instructions:
1. Download latest FortiClient version from Fortinet support portal. 2. Uninstall current version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Restrict Lua script execution
windowsDisable or restrict Lua auto patch script functionality if not required
Limit local user privileges
windowsImplement least privilege access controls to reduce attack surface
🧯 If You Can't Patch
- Implement strict access controls to limit who can log into affected systems
- Enable detailed logging and monitoring for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check FortiClient version via: Control Panel > Programs > Programs and Features, or run 'wmic product get name,version' in command promptCheck Version:
wmic product where "name like '%FortiClient%'" get name,versionVerify Fix Applied:
Verify installed version is 7.2.5+, 7.0.13+, or not 6.4.x📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Lua script execution in FortiClient logs
- SYSTEM account activity from non-admin users
Network Indicators:
- Unusual outbound connections from affected systems post-exploit
SIEM Query:
EventID=4688 AND ProcessName LIKE '%forticlient%' AND NewProcessName LIKE '%cmd%' OR '%powershell%'