CVE-2024-21762: FortiOS SSL-VPN Out-of-Bounds Write Remote Code Execution
An out-of-bounds memory write vulnerability [CWE-787] in the FortiOS sslvpnd HTTP parser allows unauthenticated remote attackers to execute arbitrary code or commands via specially crafted HTTP requests targeting exposed SSL-VPN web portal endpoints.
Technical Root Cause Analysis
The FortiOS SSL-VPN daemon (/bin/sslvpnd) implements an embedded HTTP parsing routine responsible for handling incoming client connections prior to authentication. When processing HTTP POST requests directed toward endpoints such as /remote/login or Web Mode portal paths, the parser evaluates user-supplied chunked transfer data and content length headers.
During request body dechunking, an integer signedness error and improper boundary check allow an attacker to send an oversized or malformed chunk delimiter. The parsing routine allocates a fixed heap buffer but writes parsed body contents based on an attacker-influenced length field, overflowing past the buffer boundaries. This out-of-bounds write overwrites adjacent function pointers in the process heap, leading to control-flow hijack and arbitrary code execution under root privileges.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.4 | 7.4.0 – 7.4.2 | 7.4.3+ | Upgrade firmware; disable Web Mode |
| FortiOS 7.2 | 7.2.0 – 7.2.6 | 7.2.7+ | Upgrade firmware; disable Web Mode |
| FortiOS 7.0 | 7.0.0 – 7.0.13 | 7.0.14+ | Upgrade firmware; disable Web Mode |
| FortiOS 6.4 | 6.4.0 – 6.4.14 | 6.4.15+ | Upgrade firmware; migrate to 7.2 LTS |
| FortiOS 6.2 | 6.2.0 – 6.2.15 | 6.2.16+ | Upgrade or decommission SSL-VPN |
Platform Impact: Affects all physical FortiGate hardware models (FG-40F through FG-3900E) and virtual appliances (FortiGate-VM) that have the SSL-VPN service enabled on any listening interface.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands via SSH or console to audit your SSL-VPN operational state, verify listening ports, and check for active exploitation crash signatures:
Diagnostic Commands
# 1. Audit active SSL-VPN daemon operational status and connected tunnels
diagnose vpn ssl status
# 2. Inspect kernel crashlog for sslvpnd segfaults or unexpected termination signatures
diagnose sys log crashlog read | grep -E "sslvpnd|sigsegv"
# 3. Verify SSL-VPN configuration, listening port, and source interface bindings
show vpn ssl settingsRemediation & Workaround Steps (Teaser Preview)
Follow the full production hardening workflow in the Ferrite interactive platform to eliminate exposure without unscheduled maintenance:
Frequently Asked Questions
The vulnerability resides in the HTTP request body parsing routine of the FortiOS sslvpnd daemon. Specially crafted HTTP chunked transfer requests trigger an integer signedness miscalculation, leading to an out-of-bounds write beyond allocated heap memory chunks.
Yes. Disabling Web Mode across all SSL-VPN portals prevents the vulnerable HTTP parsing path from being triggered by external actors. Restricting access using local-in policies further neutralizes exposure while planning a maintenance window.
FortiOS 7.4.3, 7.2.7, 7.0.14, 6.4.15, and 6.2.16 resolve the vulnerability. FortiOS 7.6 builds are clean by design.