CVE-2024-50562
📋 TL;DR
This vulnerability allows attackers who have obtained SSL-VPN session cookies to reuse them even after sessions have expired or been logged out. It affects FortiOS SSL-VPN in multiple versions, potentially enabling unauthorized access to VPN portals.
💻 Affected Systems
- FortiOS SSL-VPN
📦 What is this software?
Fortios by Fortinet
Fortios by Fortinet
Fortios by Fortinet
Fortisase by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
An attacker with stolen session cookies could gain persistent unauthorized access to SSL-VPN portals, potentially accessing internal network resources.
Likely Case
Attackers who obtain session cookies through other means (like XSS or malware) could maintain access after legitimate users log out.
If Mitigated
With proper session management and monitoring, impact is limited to temporary access windows.
🎯 Exploit Status
Requires possession of valid session cookies, which could be obtained through other attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Fortinet advisory for specific patched versions
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-24-339
Restart Required: Yes
Instructions:
1. Review Fortinet advisory FG-IR-24-339
2. Upgrade to patched FortiOS versions
3. Restart affected services
🔧 Temporary Workarounds
Reduce Session Timeout
allDecrease SSL-VPN session timeout values to limit exposure window
config vpn ssl settings
set idle-timeout <lower_value>
Enable Session Logging
allIncrease logging for SSL-VPN session activities
config log setting
set vpn enable enable
🧯 If You Can't Patch
- Implement network segmentation to limit SSL-VPN access to critical resources only
- Deploy additional authentication factors for SSL-VPN access
🔍 How to Verify
Check if Vulnerable:
Check FortiOS version with 'get system status' and compare to affected versions listCheck Version:
get system status | grep VersionVerify Fix Applied:
Verify upgraded version is not in affected range and test session expiration behavior📡 Detection & Monitoring
Log Indicators:
- Multiple successful logins from same session ID after logout events
- Session reuse anomalies
Network Indicators:
- Unusual SSL-VPN connection patterns
- Multiple connections with identical session tokens
SIEM Query:
source="fortigate" (event_type="vpn" AND action="login") | stats count by session_id | where count > 1