Remote Attackers Can Gain Super-Admin Privileges via Crafted Requests to Node.js Websocket Module

CVE-2024-55591

What is CVE-2024-55591?

CVE-2024-55591 is a critical security vulnerability identified in Fortinet's FortiOS and FortiProxy software, specifically versions 7.0.0 through 7.0.16 and 7.0.0 through 7.0.19, as well as 7.2.0 through 7.2.12. This vulnerability falls under the category of Authentication Bypass Using an Alternate Path or Channel (CWE-288). It allows remote attackers to bypass standard authentication mechanisms and gain super-admin privileges by sending specially crafted requests to the Node.js websocket module integrated within these systems.

The implications of this vulnerability can be severe for organizations that rely on these Fortinet products for their network security infrastructure. Attackers who successfully exploit CVE-2024-55591 can manipulate the system's operations, create unauthorized admin accounts, and exert full control over the affected devices. This could lead to unauthorized access to sensitive data, alteration of configurations, or even complete system compromise, significantly endangering the confidentiality, integrity, and availability of an organization's critical systems and data.

Potential impact of CVE-2024-55591

1. Unauthorized Access to Sensitive Systems: Exploitation of this vulnerability enables an attacker to elevate their privileges to super-admin status, allowing them to gain access to critical systems, sensitive information, and command over security policies.

2. Creation of Backdoored Accounts: Attackers can create additional privileged accounts with misleading names to maintain persistence within the network, enabling further exploitation and making it difficult for organizations to detect the breach.

3. Facilitation of Additional Attacks: With full control over compromised Fortinet devices, attackers can expand their reach within the victim's network, allowing them to execute lateral movement towards other high-value targets, conduct data exfiltration, or deploy additional malware, leading to extensive operational setbacks and potential financial loss.

News Articles

SC Media

CVE-2024-55591CVE-2025-24472

New Lockbit-linked ransomware group targets Fortinet vulnerabilities

The “SuperBlack” ransomware leverages the LockBit 3.0 builder with a custom encryption tool.

The Register

CVE-2024-55591

New ransomware gang targets Fortinet firewalls, victim data

Researchers are tracking a newly discovered ransomware group with suspected links to LockBit after a series of intrusions were reported starting in January. Forescout said the group it's tracking as Mora_001...

CISA (.gov)

CVE-2024-55591

CISA Adds Four Known Exploited Vulnerabilities to Catalog | CISA

CISA has added four vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-55591(link is external) Fortinet FortiOS Authorization Bypass...

More News...

References