## https://sploitus.com/exploit?id=0D977AF2-AB37-549D-8203-AE99EED2C10B
# CVE-2024-55591 - Fortinet FortiOS Authentication Bypass
An educational implementation in Go demonstrating the technical mechanics of **CVE-2024-55591**, an authentication bypass vulnerability affecting Fortinet FortiOS. This repository is intended strictly for security research, defensive analysis, and authorized penetration testing.
---
## How It Works
This tool is structured around two main phases (Target Validation and Exploitation) that mirror the vulnerability workflow:
### Phase 1: Target Validation & Detection
1. **Management Interface Probing:** Sends an HTTP/HTTPS GET request to `/login?redir=/ng` and inspects the response body for FortiOS signatures (`FortiOS`, `FortiGate`, `class="main-app"`, etc.).
2. **Vulnerability Check:** Queries `/service-worker.js?local_access_token=` to verify whether the target endpoint exposes internal application routing (`api/v2/static`), confirming vulnerability status.
### Phase 2: Exploitation & Command Execution
1. **WebSocket Upgrade:** Connects to the target CLI management WebSocket endpoint (`/ws/cli/open`) using a custom HTTP upgrade request, supplying the required local access token and handling WebSocket handshake framing.
2. **Authentication Bypass:** Injects crafted authentication frames containing administrative user contexts and tokens over the established WebSocket channel. Repeatedly polls the channel until a valid response confirms successful session establishment.
3. **Command Execution:** Sends formatted CLI payloads through the authenticated WebSocket connection and streams real-time standard output back to the terminal.
---
## Features
- **Robust Protocol Handling:** Supports both HTTP and HTTPS with automatic fallback options.
- **Flexible TLS Configuration:** Allows custom TLS version selection (`auto`, `1.0`, `1.1`, `1.2`, `1.3`) with insecure certificate verification for testing environments.
- **WebSocket Frame Crafting:** Implements manual WebSocket frame generation (with masking keys and payload length calculations) without relying on external third-party Gorilla WebSocket packages.
- **Configurable Parameters:** Supports custom timeouts, retry limits, and verbosity flags.
---
- WatchTowr. (2024). *Get FortiRekt: I am the super_admin now - FortiOS Authentication Bypass (CVE-2024-55591)*. watchTowr Labs. https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/