CVE-2024-55599
📋 TL;DR
This vulnerability allows remote unauthenticated attackers to bypass DNS filtering protections on Fortinet devices when Apple devices are used. It affects FortiOS and FortiProxy across multiple versions due to improper security check implementation. Organizations using these products with Apple devices in their network are at risk.
💻 Affected Systems
- FortiOS
- FortiProxy
📦 What is this software?
Fortios by Fortinet
Fortios by Fortinet
Fortios by Fortinet
Fortiproxy by Fortinet
Fortiproxy by Fortinet
Fortisase by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass DNS filtering to access malicious domains, potentially leading to malware infections, data exfiltration, or command and control communications.
Likely Case
Users could bypass corporate DNS filtering policies to access blocked websites or services, compromising security policies.
If Mitigated
With proper network segmentation and additional security controls, impact is limited to DNS filtering bypass only.
🎯 Exploit Status
Vulnerability is triggered by Apple devices making DNS requests. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiOS 7.6.1, 7.4.8, 7.2.7, 7.0.14, 6.4.15; FortiProxy 7.6.2, 7.4.9, 7.2.8, 7.0.15
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-24-053
Restart Required: Yes
Instructions:
1. Download appropriate firmware version from Fortinet support portal. 2. Backup current configuration. 3. Upload and install firmware update via web interface or CLI. 4. Reboot device after installation. 5. Verify DNS filtering functionality.
🔧 Temporary Workarounds
Restrict Apple Device Access
allTemporarily block or restrict Apple devices from accessing DNS filtering services
config firewall address
edit apple-device-block
set type ipmask
set subnet 192.168.1.0 255.255.255.0
next
config firewall policy
edit 0
set srcaddr apple-device-block
set action deny
set service DNS
end
Enable Additional DNS Security
allImplement DNSSEC or use additional DNS security layers
config system dns-database
edit dnssec-profile
set dnssec enable
set dnssec-mode validate
end
🧯 If You Can't Patch
- Implement network segmentation to isolate Apple devices from critical resources
- Deploy additional DNS filtering solutions as a compensating control
🔍 How to Verify
Check if Vulnerable:
Check FortiOS/FortiProxy version via web interface or CLI. If running affected versions and DNS filtering is enabled, system is vulnerable.Check Version:
get system status | grep VersionVerify Fix Applied:
After patching, test DNS filtering with Apple devices to confirm bypass is no longer possible.📡 Detection & Monitoring
Log Indicators:
- DNS queries from Apple devices bypassing filter policies
- Unexpected successful DNS resolutions to blocked domains
Network Indicators:
- DNS traffic from Apple devices to unexpected external resolvers
- Increased DNS query volume from Apple devices
SIEM Query:
source="fortigate" (dns.query="*blocked-domain*" AND device.vendor="Apple")