CVE-2024-55591
FortiOS & FortiProxy Authentication Bypass via Node.js WebSocket
Critical authentication bypass vulnerability actively exploited since November 2024. Remote unauthenticated attackers gain super-admin privileges via the Node.js WebSocket module. CISA KEV listed.
Download Full Vulnerability Advisory
Complete technical analysis with IOCs, detection queries, remediation steps, and references.
1 Executive Summary
CVE-2024-55591 has been actively exploited since mid-November 2024, weeks before public disclosure. Threat actors are gaining super-admin privileges on FortiGate firewalls, creating rogue accounts, and using SSL VPN to tunnel into enterprise networks. CISA added this to the KEV catalog on January 17, 2025.
CVE-2024-55591 is an authentication bypass vulnerability in Fortinet FortiOS and FortiProxy. A remote, unauthenticated attacker can send specially crafted requests to the Node.js websocket module to gain super-admin privileges on vulnerable devices. This allows complete control over the firewall, including creating admin accounts, modifying policies, and enabling VPN access for lateral movement into internal networks.
Exploitation Impact
2 Affected Products
FortiOS 7.6.x, 7.4.x, 7.2.x, 6.4.x and FortiProxy 7.6.x, 7.4.x, 2.0.x are NOT vulnerable.
3 Exploitation Timeline
Arctic Wolf documented a coordinated attack campaign exploiting this vulnerability before public disclosure:
4 Detection
Key indicators to identify exploitation attempts in your environment.
FortiGate Log Pattern - Suspicious jsconsole Activity
type="event" subtype="system" level="information"
logdesc="Admin login successful" user="Local_Process_Access"
ui="jsconsole" srcip=1.1.1.1 dstip=1.1.1.1 action="login" status="success"Note: The srcip and dstip values are attacker-controlled and spoofed. Do not rely on these IPs for attribution.
Behavioral Indicators
FortiGate CLI - Check for Unauthorized Accounts
diagnose sys admin list # Review for unexpected admin accounts
config system admin show # Audit all admin accounts and creation dates
diagnose debug config-error-log read # Check for configuration changesNeed More Detection Queries?
The full advisory includes additional log patterns and compromise assessment queries.
5 Remediation
Post-Compromise Actions
If exploitation is suspected or confirmed:
- Audit all admin accounts - Remove any unauthorized accounts immediately
- Audit local users - Check for users added to SSL VPN groups
- Review firewall policies - Identify and revert unauthorized changes
- Reset all admin credentials - Change passwords for all legitimate admin accounts
- Review VPN logs - Identify any unauthorized VPN tunnels
- Forensic investigation - Assess lateral movement into internal network
Active Threat Actor Exploitation
This vulnerability is being actively exploited by ransomware operators for initial access.
View Qilin Ransomware ProfileRelated Reports
Track CVE-2024-55591 Exploitation with BRACE
BRACE delivers monthly threat intelligence covering this vulnerability and 500+ other exploited CVEs with detection rules and hunting playbooks for your sector.