ScaryByte R&D PoC for CVE-2024-55591

A comprehensive all-in-one Python-based Proof of Concept script to discover and exploit a critical authentication bypass vulnerability (CVE-2024-55591) in certain Fortinet devices. This script:

1. Installs Missing Dependencies automatically
2. Optionally Scans a target host for open ports using nmap
3. Performs Pre-flight Checks to ensure the service is a Fortinet device and is vulnerable
4. Exploits the WebSocket interface to hijack a Telnet-like CLI session
5. Runs an Initial or Multiple Commands post-exploit
6. Checks the Device Version against known vulnerable ranges from Fortinet PSIRT FG-IR-24-535

---

Table of Contents

• Vulnerability Summary
• Affected Versions
• Pre-Requisites
• Usage
  • 1. Clone & Install
  • 2. Run the Script
  • 3. Follow the Wizard
• Features
  • Automatic Dependency Installation
  • Optional Nmap SYN Scanning
  • Multi-Port Testing
  • Post-Exploitation Commands
  • Version Parsing and Vulnerability Check
• Example Walkthrough
  • 1. Initial Wizard Prompts
  • 2. Nmap Results & Port Selection
  • 3. Exploitation Flow
  • 4. Post-Exploitation Flow
• Disclaimer

---

Vulnerability Summary

CVE-2024-55591 is a critical authentication bypass in certain Fortinet products (FortiOS & FortiProxy). By exploiting a flaw in the WebSocket/Telnet management interface, an attacker can gain privileged CLI access without valid credentials.

Affected Versions

According to the Fortinet PSIRT Advisory (FG-IR-24-535), the following versions are known to be affected:

• FortiOS: 7.0.0 to 7.0.16
• FortiProxy: 7.0.0 to 7.0.19, 7.2.0 to 7.2.12

Pre-Requisites

• Python 3.x
• (Optional) Nmap for automatic port scanning
• Network access to the target device
• Sufficient privileges on your local machine to install missing Python packages (if needed)

Usage

1. Clone & Install

git clone https://github.com/exfil0/CVE-2024-55591-POC.git
cd CVE-2024-55591-POC

2. Run the Script

python3 attack.py

When executed, the script automatically checks for missing Python dependencies (requests, urllib3) and attempts to install them.

3. Follow the Wizard

You will be prompted for:

1. Target IP/Hostname
2. Whether to run Nmap to find open ports
3. If multiple open ports are found, whether to test ALL or just one
4. Whether to use SSL
5. A Command to run initially (you can select from a pre-defined list or supply your own)
6. (Optional) Whether to run post-exploitation commands

Once you confirm, the script tests connectivity, checks vulnerability, upgrades the connection to WebSocket, and attempts the auth bypass.

---

Features

Automatic Dependency Installation

At startup, this script checks for requests and urllib3. If missing, it attempts to install them via pip.

Optional Nmap SYN Scanning

If you choose, the script runs nmap -sS -p- --min-rate 500 <host> to discover open TCP ports, then either:

• Tries all the discovered ports
• Lets you pick one

Multi-Port Testing

If multiple ports are discovered open, you can instruct the script to test them all. This is useful if Fortinet services are listening on non-standard ports.

Post-Exploitation Commands

If the exploit succeeds, you can optionally run additional commands in the same Telnet session, such as:

• diag sys top
• diag debug crashlog read
• execute shell

You can modify these post-exploitation commands in the script to gather more advanced data.

Version Parsing and Vulnerability Check

The script attempts to parse the device version from the output of get system status or get system info. If it matches a known vulnerable range, it notifies you.

---

Example Walkthrough

1. Initial Wizard Prompts

1. Target IP: e.g., 192.168.1.50
2. Nmap scan?: y (Yes) to discover open ports
3. SSL?: Typically y if connecting via HTTPS/443
4. Initial Command: e.g., get system status
5. Post-exploit commands: y or n

2. Nmap Results & Port Selection

If Nmap finds multiple open ports, you can choose to test all ports automatically or pick a specific one.

3. Exploitation Flow

• The script checks if /login?redir=/ng returns Fortinet’s management interface
• The script checks if service-worker.js?local_access_token=ScaryBYte contains the substring api/v2/static
• If both checks pass, it attempts the WebSocket upgrade and sends a fake Telnet login context
• Once you have a Telnet-like CLI, you can run commands like get system status

4. Post-Exploitation Flow

If post-exploit mode is enabled, the script sends additional debug or system commands. The output is collected and displayed in your console.

---

Disclaimer

This Proof of Concept script is provided for educational and testing purposes only. Unauthorized exploitation of systems without explicit permission is illegal. Always ensure you have the appropriate approvals before scanning or testing any systems, and refer to Fortinet’s Advisory (FG-IR-24-535) for patch information.