CVE-2024-23113

What is Fortinet

Fortinet is a cybersecurity company known for its wide range of network security products, including firewalls, intrusion prevention systems (IPS), VPNs, endpoint security solutions, and secure access technologies. Its main product is FortiGate, a next-generation Firewall that combines multiple security features, such as antivirus, web filtering, application control, and intrusion detection, into a single platform.

Attackers specifically target Fortinet products such as VPNs as they provide a direct gateway into internal networks. Misconfigurations or vulnerabilities in VPNs can allow unauthorized remote access, potentially bypassing other security controls. Additionally, Fortinet’s solutions are often deployed to protect critical infrastructure, such as financial services, healthcare, and government networks. Compromising these systems offers attackers access to sensitive information, and potentially control over important network assets, making them attractive targets.

Why Attacks on Fortinet are Often Successful ?

1. Unpatched Vulnerabilities: Despite Fortinet’s patch releases, organizations usually fail to apply updates in a timely manner, leaving their systems exposed to known vulnerabilities. Attackers often exploit these unpatched systems.
2. Misconfigurations: Improperly configured firewalls or VPNs can leave open access points or allow unauthorized traffic. Misconfigurations are a common problem because the complexity of the systems can lead to human error during setup or administration.

CVE-2024-23113 (Format String Vulnerability)

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

What is a Format String Vulnerability

The Format String exploit occurs when the submitted data of an input string is evaluated as a command by the application. In this way, the attacker could execute code, read the stack, or cause a segmentation fault in the running application, causing new behaviors that could compromise the security or the stability of the system.