CVE-2024-21762 — Fortinet FortiOS Out-of-Bounds Write

Key facts

CVE-2024-21762 (Fortinet) is a Critical (9.6) vulnerability: Fortinet FortiOS Out-of-Bounds Write. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-02-09), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

Actively exploited — on the CISA KEV catalog

CVE-2024-21762 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-02-09), confirming exploitation in the wild. It is linked to known ransomware campaigns. Federal remediation deadline: 2024-02-16. Prioritise patching and deploy the detection and prevention rules below.

CVE	CVE-2024-21762
Severity	Critical (9.6)
CISA KEV	Actively exploited (added 2024-02-09) · ransomware
Vendor	Fortinet
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2024/CVE-2024-21762/

Details

CVE-2024-21762 (Fortinet) is a Critical (9.6) vulnerability: Fortinet FortiOS Out-of-Bounds Write. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Description

Out-of-bounds write in SSL VPN component

Affected Versions

• FortiOS 7.4.0-7.4.2, 7.2.0-7.2.6, 7.0.0-7.0.13, 6.4.0-6.4.14, 6.2.0-6.2.15

Mitigation

1. Apply patches immediately
2. Monitor for exploitation
3. Implement access controls

Verification Process

The PoC uses a multi-stage verification approach:

Step 1: Product/Version Detection (Passive)

[*] Query target endpoint
[*] Detect product signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active Vulnerability Testing

Method	Description	Detection
Error-based	Tests for error messages indicating vulnerability	Error indicators in response
Timing-based	Measures response delay with payload	Response time significantly longer
Response-based	Checks for expected patterns in response	Vulnerability indicators present

Verification Flow

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  Query target → Detect product/version                      │
│  Check if version in vulnerable range                       │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Vulnerability Testing                   │
│                                                              │
│  1. Error-based Test                                         │
│     └─ Send payload → Check for error indicators            │
│     └─ If error found → CONFIRMED VULNERABLE                │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Send delay payload → Measure response time           │
│     └─ If delayed → CONFIRMED VULNERABLE                    │
│                                                              │
│  3. Response-based Test                                      │
│     └─ Send payload → Check response content                │
│     └─ If pattern matches → CONFIRMED VULNERABLE            │
└─────────────────────────────────────────────────────────────┘

Usage

# Full vulnerability check (version + active testing)
python3 poc.py -t https://target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://target.com -c --version-only

References

• NVD

Detection and prevention

Ready-to-deploy defensive rules for CVE-2024-21762, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2024-21762 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2024-21762 - Fortinet FortiOS SSL VPN Snort Detection Rules
# Severity: Critical (CVSS 9.8)

# Alert on access to vulnerable FortiOS SSL VPN endpoints
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-21762 FortiOS SSL VPN Hostcheck Validate Access";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/remote/hostcheck_validate"; http_uri;
    classtype:web-application-attack;
    sid:2024217621;
    rev:1;
    metadata:cve CVE-2024-21762, severity critical;
)

# Detect chunked transfer encoding exploitation attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-21762 FortiOS Chunked Encoding Exploit Attempt";
    flow:to_server,established;
    content:"/remote/"; http_uri;
    content:"Transfer-Encoding"; http_header;
    content:"chunked"; http_header;
    pcre:"/Content-Length:\s*[0-9]{6,}/Hi";
    classtype:attempted-admin;
    sid:2024217622;
    rev:1;
    metadata:cve CVE-2024-21762, severity critical;
)

# Detect oversized requests to SSL VPN endpoints
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-21762 FortiOS Oversized Request";
    flow:to_server,established;
    content:"/remote/"; http_uri;
    content:"Content-Length"; http_header;
    pcre:"/Content-Length:\s*[1-9][0-9]{7,}/Hi";
    classtype:attempted-admin;
    sid:2024217623;
    rev:1;
    metadata:cve CVE-2024-21762, severity critical;
)

# Detect potential FortiOS reconnaissance
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-21762 FortiOS SSL VPN Reconnaissance";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/remote/info"; http_uri;
    classtype:attempted-recon;
    sid:2024217624;
    rev:1;
    metadata:cve CVE-2024-21762, severity high;
)

# Detect login check exploitation
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-21762 FortiOS Login Check Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/remote/logincheck"; http_uri;
    content:"Transfer-Encoding"; http_header;
    classtype:attempted-admin;
    sid:2024217625;
    rev:1;
    metadata:cve CVE-2024-21762, severity critical;
)

# Rate-based detection for brute force attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2024-21762 FortiOS Brute Force Attempt";
    flow:to_server,established;
    content:"/remote/"; http_uri;
    detection_filter:track by_src, count 20, seconds 60;
    classtype:attempted-admin;
    sid:2024217626;
    rev:1;
    metadata:cve CVE-2024-21762, severity high;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2024-21762 - Fortinet FortiOS SSL VPN YARA Detection Rules
 * Severity: Critical (CVSS 9.8)
 * Use for network traffic analysis and file scanning
 */

rule CVE_2024_21762_Exploit_Request {
    meta:
        description = "Detects CVE-2024-21762 FortiOS SSL VPN exploitation attempts"
        author = "Security Research"
        date = "2024-02-09"
        cve = "CVE-2024-21762"
        severity = "critical"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-21762"

    strings:
        $uri1 = "/remote/hostcheck_validate" ascii wide
        $uri2 = "/remote/logincheck" ascii wide
        $uri3 = "/remote/info" ascii wide

        $header1 = "Transfer-Encoding: chunked" ascii wide nocase
        $header2 = "Transfer-Encoding:" ascii wide nocase

        $method1 = "POST /remote/" ascii wide
        $method2 = "PUT /remote/" ascii wide

        // Malformed chunked encoding patterns
        $chunk1 = /[0-9a-fA-F]{1,8}\r\n.{0,100}\r\n0\r\n\r\n/ ascii
        $chunk2 = "0\r\n\r\n" ascii

    condition:
        (any of ($uri*) and any of ($header*)) or
        (any of ($method*) and $header2 and any of ($chunk*))
}

rule CVE_2024_21762_Payload_Pattern {
    meta:
        description = "Detects potential payload patterns for CVE-2024-21762"
        author = "Security Research"
        date = "2024-02-09"
        cve = "CVE-2024-21762"
        severity = "critical"

    strings:
        // Shell command patterns that may appear in exploit
        $cmd1 = "/bin/sh" ascii wide
        $cmd2 = "/bin/bash" ascii wide
        $cmd3 = "wget " ascii wide
        $cmd4 = "curl " ascii wide
        $cmd5 = "nc -e" ascii wide
        $cmd6 = "python -c" ascii wide

        // FortiOS specific paths
        $path1 = "/data/etc/ssl" ascii wide
        $path2 = "/dev/cmdb" ascii wide
        $path3 = "/data2/log" ascii wide

        // Context indicators
        $ctx1 = "FortiGate" ascii wide nocase
        $ctx2 = "FortiOS" ascii wide nocase

    condition:
        any of ($ctx*) and any of ($cmd*) and any of ($path*)
}

rule CVE_2024_21762_Webshell {
    meta:
        description = "Detects webshells that may be deployed via CVE-2024-21762"
        author = "Security Research"
        date = "2024-02-09"
        cve = "CVE-2024-21762"
        severity = "critical"

    strings:
        $php1 = "<?php" ascii wide
        $php2 = "eval(" ascii wide
        $php3 = "base64_decode(" ascii wide
        $php4 = "system(" ascii wide
        $php5 = "exec(" ascii wide
        $php6 = "passthru(" ascii wide
        $php7 = "shell_exec(" ascii wide

        // Python patterns
        $py1 = "import os" ascii wide
        $py2 = "subprocess" ascii wide
        $py3 = "os.system" ascii wide

        // FortiOS context
        $forti1 = "fgtlog" ascii wide
        $forti2 = "fortigate" ascii wide nocase

    condition:
        (3 of ($php*)) or
        (2 of ($py*) and any of ($forti*))
}

rule CVE_2024_21762_Network_IOC {
    meta:
        description = "Network-based indicators for CVE-2024-21762 exploitation"
        author = "Security Research"
        date = "2024-02-09"
        cve = "CVE-2024-21762"
        severity = "high"

    strings:
        // HTTP request patterns
        $http1 = "POST /remote/hostcheck_validate HTTP" ascii wide
        $http2 = "POST /remote/logincheck HTTP" ascii wide

        // Suspicious headers combination
        $hdr1 = "Content-Length:" ascii wide nocase
        $hdr2 = "Transfer-Encoding:" ascii wide nocase

        // Attack tool signatures
        $tool1 = "python-requests" ascii wide nocase
        $tool2 = "Go-http-client" ascii wide nocase

    condition:
        any of ($http*) and ($hdr1 and $hdr2)
}

:material-file-download: prevention/yara.yar

# CVE-2024-21762 - Fortinet FortiOS SSL VPN Prevention Rules for Nginx
# Use as reverse proxy protection layer

# Block suspicious requests to FortiOS SSL VPN endpoints
location /remote/ {
    # Block requests with suspicious chunked encoding patterns
    if ($http_transfer_encoding ~* "chunked") {
        set $block_request "1";
    }

    # Block oversized content-length headers
    if ($content_length > 10485760) {
        return 413;
    }

    # Block suspicious user agents
    if ($http_user_agent ~* "(curl|wget|python|scanner|nikto)") {
        return 403;
    }

    # Rate limiting for SSL VPN endpoints
    limit_req zone=sslvpn_limit burst=10 nodelay;
    limit_conn sslvpn_conn 10;

    # Proxy to backend FortiGate (if used as reverse proxy)
    # proxy_pass https://fortigate-backend;

    deny all;
}

# Block direct access to vulnerable endpoints
location ~* ^/remote/(hostcheck_validate|logincheck|info) {
    # Log and block exploitation attempts
    access_log /var/log/nginx/cve-2024-21762-attempts.log;
    return 403;
}

# Rate limiting zone definitions (add to http block)
# limit_req_zone $binary_remote_addr zone=sslvpn_limit:10m rate=5r/s;
# limit_conn_zone $binary_remote_addr zone=sslvpn_conn:10m;

# Block malformed HTTP requests
server {
    # Reject requests with invalid headers
    ignore_invalid_headers on;

    # Limit request body size
    client_max_body_size 10M;

    # Timeout settings to prevent slow attacks
    client_body_timeout 10s;
    client_header_timeout 10s;

    # Block requests with null bytes
    if ($request_uri ~* "\x00") {
        return 400;
    }
}

:material-file-download: prevention/nginx.conf

# CVE-2024-21762 - Fortinet FortiOS SSL VPN Prevention Rules for Apache HTTPD
# Use as reverse proxy protection layer

# Enable required modules
# LoadModule rewrite_module modules/mod_rewrite.so
# LoadModule security2_module modules/mod_security2.so
# LoadModule proxy_module modules/mod_proxy.so

# Block access to FortiOS SSL VPN vulnerable endpoints
<LocationMatch "^/remote/(hostcheck_validate|logincheck|info)">
    # Log exploitation attempts
    CustomLog /var/log/httpd/cve-2024-21762-attempts.log combined

    # Deny all access
    Require all denied
</LocationMatch>

# Block suspicious requests to /remote/ path
<Location "/remote/">
    # Block requests with suspicious Transfer-Encoding
    SetEnvIfNoCase Transfer-Encoding chunked block_chunked=1

    <If "env('block_chunked') == '1'">
        Require all denied
    </If>

    # Limit request body size
    LimitRequestBody 10485760

    # Rate limiting (requires mod_ratelimit)
    SetOutputFilter RATE_LIMIT
    SetEnv rate-limit 500
</Location>

# ModSecurity Rules for CVE-2024-21762
<IfModule mod_security2.c>
    # Block FortiOS exploitation patterns
    SecRule REQUEST_URI "@contains /remote/hostcheck_validate" \
        "id:2024217621,phase:1,deny,status:403,\
        msg:'CVE-2024-21762 FortiOS Exploitation Attempt',\
        logdata:'%{REQUEST_URI}',severity:CRITICAL"

    # Block oversized chunked requests
    SecRule REQUEST_HEADERS:Transfer-Encoding "@streq chunked" \
        "id:2024217622,phase:1,chain,deny,status:403,\
        msg:'CVE-2024-21762 Chunked Encoding Attack'"
        SecRule REQUEST_HEADERS:Content-Length "@gt 1048576" ""

    # Block malformed requests to SSL VPN
    SecRule REQUEST_URI "@rx ^/remote/.*\x00" \
        "id:2024217623,phase:1,deny,status:400,\
        msg:'CVE-2024-21762 Null Byte Injection'"
</IfModule>

# Logging for security monitoring
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{Transfer-Encoding}i" security
CustomLog /var/log/httpd/security.log security

# Block common attack tools
<If "%{HTTP_USER_AGENT} =~ /(curl|wget|python-requests|scanner|nikto|sqlmap)/i">
    Require all denied
</If>

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2024-21762?

CVE-2024-21762 (Fortinet) is a Critical (9.6) vulnerability: Fortinet FortiOS Out-of-Bounds Write. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-02-09), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

How do I detect CVE-2024-21762?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2024-21762?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Is CVE-2024-21762 actively exploited?

Yes. CVE-2024-21762 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2024-02-09, which means it has been exploited in the wild. CISA also links it to known ransomware campaigns. CISA set a federal remediation deadline of 2024-02-16. Prioritise patching and deploy the detection and prevention rules above.

Related CVEs

Other entries for the same vendor or product:

• CVE-2024-23113 — Fortinet FortiOS Format String RCE (Critical (9.8))
• CVE-2024-47575 — FortiManager Auth Bypass (Critical (9.8))
• CVE-2024-55591 — FortiOS Auth Bypass (Critical (9.8))
• CVE-2024-11616 — Fortinet FortiOS SSL VPN (Critical (9.3))

---

For authorized security testing and research only. See the full source and NVD record.