CVE-2024-55591 : Fortios auth-bypass

[Basile-Professional]

Initial Access T1190 Exploit Public-Facing Application Attackers exploit the FortiGate WebSocket vulnerability to gain access to the system without authentication.

Local setup

make a fake server with the key aspects in the comment on the router of my lab
Attack it with an exterior machine and the PoC
Capture the Network traffic of the attack with Tcpdump
find a way to spot it though the pcap

External sources

https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591/blob/main/CVE-2024-55591-PoC.py
https://github.com/sysirq/fortios-auth-bypass-poc-CVE-2024-55591
https://github.com/exfil0/CVE-2024-55591-POC/tree/main

[V2UgY2FycnkgRWRlbg]

To simulate CVE-2024-55591, you need to reproduce just these key aspects:

An HTTP(S) server that:

Has a /login?redir=/ng endpoint returning fake Fortinet-like HTML.

Has a /service-worker.js?local_access_token=... endpoint that responds in a way the PoCs expect.

A working WebSocket server that:

Listens on /ws/cli/open?local_access_token=...

Accepts raw WebSocket frames.

Responds just enough to simulate a CLI shell over WebSocket (like FortiGate's jsconsole).