CVE-2024-21762

CVE-2024-21762 is an out-of-bounds write vulnerability in the FortiOS SSL VPN daemon (sslvpnd). The flaw exists in the HTTP chunked transfer encoding parser. By sending specially crafted HTTP requests with manipulated chunk trailers, an unauthenticated attacker can trigger a stack-based buffer overflow, ultimately achieving remote code execution on the device.

Key Facts

FortiOS Affected Versions

FortiProxy Affected Versions

Vulnerability Mechanism

The vulnerability exists in the HTTP chunked transfer encoding parser within sslvpnd, the SSL VPN daemon. The flaw is in function FUN_01701ee0 which processes HTTP trailers following chunked data.

Root Cause

When processing HTTP trailers after a zero-length final chunk, the vulnerable code writes carriage return and line feed characters (0x0d0a) beyond the allocated buffer without proper bounds checking. The offset used for writing increments with each trailer encountered but is never validated against the remaining buffer space.

/* Simplified vulnerable logic */
offset = 0;
for (each trailer in request) {
    buffer[offset] = 0x0d;     // Carriage return
    buffer[offset + 1] = 0x0a; // Line feed
    offset += 2;
    // NO CHECK: offset > buffer_size
}
// Result: Stack overflow with limited data (0x0d0a only)

Exploitation Chain

Despite only being able to write two bytes (0x0a0d) past the buffer, researchers at Assetnote demonstrated this is sufficient for reliable RCE:

Key Technical Details

Network-Based Detection

Monitor for exploitation attempts at the network level:

Host-Based Detection

Vulnerability Scanning

Use the Nuclei template for authorized testing:

nuclei -t cves/2024/CVE-2024-21762.yaml -u https://target.com:10443

# Note: Use only against systems you own or have authorization to test

Patching Guidance

Apply the appropriate patch for your FortiOS/FortiProxy version:

Temporary Workaround

If immediate patching is not possible, disable SSL VPN functionality:

config vpn ssl settings
    set status disable
end

Post-Compromise Actions

If exploitation is suspected:

1. Isolate the device - Disconnect from network if possible
2. Forensic imaging - Capture memory and disk for analysis
3. Review process list - Check for unusual processes spawned from sslvpnd
4. Review network connections - Identify reverse shells or C2 traffic
5. Assume breach - Investigate lateral movement into internal network
6. Rebuild device - Do not trust patching alone after confirmed compromise

Volt Typhoon

Fortinet has disclosed that Volt Typhoon, a Chinese state-sponsored threat actor, has been targeting FortiOS vulnerabilities to deploy custom malware. Volt Typhoon is known for:

• Living-off-the-land techniques for persistence
• Targeting critical infrastructure (energy, water, telecommunications)
• Pre-positioning for potential disruptive operations
• Extended dwell times with minimal detection

Ransomware Affiliates

Qilin ransomware affiliates have been observed exploiting CVE-2024-21762 for initial access to enterprise networks. After exploiting FortiGate devices, they proceed with:

• Credential harvesting from Veeam backups
• Lateral movement via RDP and admin shares
• Chrome credential theft via GPO
• Data exfiltration before encryption