CVE-2024-55591: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CVE-2024-55591 is an authentication bypass vulnerability in Fortinet FortiOS and FortiProxy. It can let an unauthenticated remote attacker gain super-admin privileges by sending crafted requests to the Node.js websocket module. Because successful abuse yields full administrative control of the device, the issue is high-impact for any organization that relies on these products for network security or proxy services. CISA notes that the vulnerability has been used by ransomware operators, so rapid identification and remediation are essential.

Defenders should treat any internet-facing or management-exposed FortiOS or FortiProxy instance as potentially at risk until the vendor advisory has been reviewed and the recommended updates or mitigations applied.

How it works

The weakness is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). In this case the alternate path is the Node.js websocket module. An attacker who can reach that interface may craft requests that skip normal authentication checks and obtain super-admin rights. Once those privileges are obtained, the attacker can reconfigure the device, create new accounts, alter policies, or pivot deeper into the network. Exact request formats and conditions are not detailed here; they must be confirmed against the vendor advisory. The core risk is that no valid credentials are required if the vulnerable path is reachable.

Am I affected? How to find it in your systems

FortiOS typically runs on Fortinet firewalls, gateways, and related appliances; FortiProxy is used for secure web-proxy and content-filtering deployments. Both products are commonly placed at network perimeters or in DMZs, so management interfaces or websocket endpoints may be reachable from untrusted networks.

• Inventory all Fortinet devices by querying asset-management systems, network-management platforms, or by scanning for Fortinet management ports and banners.
• Record the exact product (FortiOS or FortiProxy) and the firmware or software version currently installed; compare those versions against the list of affected releases published in the vendor advisory.
• Identify whether the Node.js websocket module or any related administrative websocket services are enabled and exposed.
• Review authentication and administrative logs for unexpected super-admin sessions, websocket connection attempts from unusual sources, or configuration changes that lack corresponding change-control tickets.
• Check for anomalous outbound traffic or new administrative accounts that appear after the vulnerability became public knowledge.

Any device whose version falls within the affected range, or whose exposure status cannot be confirmed, should be treated as vulnerable until proven otherwise.

How to remediate

The primary remediation is to apply the vendor-supplied update that addresses CVE-2024-55591. Follow the exact upgrade path and release notes provided by Fortinet; do not rely on version numbers or patch identifiers that are not listed in the official advisory.

• Schedule and test the update in a non-production environment first, then deploy to production devices during a maintenance window.
• After patching, re-verify that the Node.js websocket module no longer accepts unauthenticated administrative requests.
• Rotate any administrative credentials that may have been used on the device, and review the configuration for unauthorized changes.
• If the product cannot be patched, CISA directs organizations to apply the mitigations listed by the vendor or to discontinue use of the product until a fix is available.

Document the remediation steps and retain evidence of the applied update for audit and incident-response purposes.

If you can't patch immediately

When an immediate upgrade is not feasible, reduce exposure with compensating controls while planning the permanent fix.

• Restrict access to management interfaces and websocket endpoints to a small set of trusted administrative networks or jump hosts; block all other sources at the network layer.
• Place a web-application firewall or reverse-proxy rule in front of the device that can detect and drop anomalous websocket requests; treat this as virtual patching only until the real update is installed.
• Disable the Node.js websocket module or any non-essential administrative features if the vendor documentation permits it without breaking required functionality.
• Increase logging verbosity for authentication and administrative events, and forward those logs to a SIEM or central collector for real-time alerting on super-admin activity or unexpected websocket traffic.
• Segment the Fortinet device so that even if it is compromised, lateral movement to critical internal systems is limited.

These measures lower risk but do not eliminate it; schedule the official patch as soon as operationally possible.

If your data may have been exposed

Because this vulnerability has been exploited by ransomware groups, any successful compromise can lead to data theft, encryption, or further network intrusion. If logs or other indicators suggest the device was accessed by an unauthenticated attacker, treat the incident as a potential breach: isolate the device, preserve forensic evidence, and follow your incident-response plan. Organizations can also run a free exposure scan of their email addresses against known breach data sets to determine whether credentials or other information associated with their domain have already appeared in public dumps.