Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy CVE-2024-55591

## https://sploitus.com/exploit?id=018BE078-A394-5938-92DA-78B2A142B030
# CVE-2024-55591
A Fortinet FortiOS Authentication Bypass Vulnerable Behaviour Detection
 

# Detection in Action


```
python CVE-2024-55591-check.py --target 192.168.1.10 --port 443
             __         ___  ___________                   
     __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________ 
     \ \/ \/ \__  \    ___/ ___\|  |  \\|    | /  _ \ \/ \/ \_  __ \
      \     / / __ \|  | \  \\___|   Y  |    |(  <_> \     / |  | \
       \/\_/ (____  |__|  \\\\___  |___|__|__  | \\__  / \\/\_/  |__|   
                  \\          \\     \\                              

        CVE-2024-55591.py
        (*) Fortinet FortiOS Authentication Bypass (CVE-2024-55591) vulnerable detection by watchTowr
        
          - Sonny , watchTowr (sonny@watchTowr.com)
          - Aliz Hammond, watchTowr (aliz@watchTowr.com)

        CVEs: [CVE-2024-55591]

[*] Targeting: https://192.168.1.10:443
[!] VULNERABLE: All conditions were met

```

# Description

This script attempts to create a WebSocket connection at a random URI from a pre-authenticated perspective to the FortiOS management interface, and reviews the response to determine if the instance is vulnerable.

# Affected Versions

* FortiOS 7.0.0 through 7.0.16
* FortiProxy 7.0.0 through 7.0.19
* FortiProxy 7.2.0 through 7.2.12

More details at [Fortinet advisory](https://www.fortiguard.com/psirt/FG-IR-24-535)

# Note

This detection mechanism doesn't support FortiProxy.

# Follow [watchTowr](https://watchTowr.com) Labs

For the latest security research follow the [watchTowr](https://watchTowr.com) Labs Team 

- https://labs.watchtowr.com/
- https://x.com/watchtowrcyber