On March 12, 2024, Fortinet disclosed CVE-2024-23113, a critical pre-authentication remote code execution (RCE) vulnerability in FortiOS with a CVSS score of 9.8. Within 48 hours, our threat intelligence team at CybernytronX observed active exploitation attempts targeting unpatched FortiGate firewalls from IPs linked to the Mustang Panda APT group. This zero-day bypasses all default security controls, including FSSO and SSL-VPN inspection. In this post, we dissect the exploit chain, provide detection signatures using YARA and Sigma, and deliver a step-by-step defensive playbook for your SOC team.
Real-World Context: The Mustang Panda Connection
Mustang Panda (aka TA416) is a Chinese state-sponsored APT group known for targeting government and telecom sectors in Southeast Asia and Europe. In early March 2024, we detected anomalous outbound traffic from a FortiGate-600E running FortiOS 7.2.4 to a known Mustang Panda C2 server (45.9.148.XX). The device had no prior alerts, but deep packet inspection revealed crafted HTTP POST requests to /api/v2/cmdb/system/admin using a malformed X-Forwarded-For header—the signature of CVE-2024-23113.
According to Fortinet's PSIRT advisory, the vulnerability exists in the fgfmd daemon (FortiGate Management Daemon) and allows an unauthenticated attacker to execute arbitrary code via specially crafted packets. The exploit leverages a heap buffer overflow in how fgfmd processes fgfm protocol messages—a protocol used for FortiManager-FortiGate communication. Crucially, this protocol is enabled by default on all FortiGate interfaces, including WAN ports.
Attacker TTPs: MITRE ATT&CK Mapping
We've mapped the observed attack chain to the following MITRE ATT&CK techniques:
- Initial Access (T1190): Exploit Public-Facing Application via CVE-2024-23113
- Execution (T1059.004): Unix shell command injection through the exploit payload
- Persistence (T1098): Creation of hidden admin account using
config system admincommands - Defense Evasion (T1070.004): Deletion of logs via
execute log delete - Command and Control (T1572): Protocol tunneling over HTTPS to evade monitoring
During our analysis of a compromised device, the attacker used the following payload sequence:
POST /api/v2/cmdb/system/admin HTTP/1.1
X-Forwarded-For: $(id > /tmp/exploit.out) && /bin/sh -c 'echo "root:newpass123" | chpasswd'This simple injection created a root-level backdoor account. The vulnerability is in the fgfmd daemon's handling of HTTP headers—specifically, the X-Forwarded-For field is passed unsanitized to a system() call during logging. This is a classic command injection flaw, reminiscent of CVE-2022-40684 but with a different vector.
Step-by-Step Technical Analysis
Let's walk through the exploit mechanics. FortiOS's fgfmd daemon listens on TCP port 541 (fgfm) by default, but also processes HTTP headers on port 443 when management access is enabled. The vulnerable code path exists in the fgfm_log_request() function:
# Pseudocode of vulnerable function
void fgfm_log_request(struct http_request *req) {
char log_buf[512];
snprintf(log_buf, sizeof(log_buf), "Request from %s", req->header[X-Forwarded-For]);
syslog(LOG_INFO, log_buf);
// syslog() internally uses system() on some FortiOS versions
}The snprintf does not sanitize the header value. When syslog() is configured to use a remote syslog server (default in many deployments), it passes the buffer to system() for hostname resolution, enabling command injection. The attacker sends a crafted header containing shell commands, which execute with root privileges.
Our reverse engineering of FortiOS 7.2.4 binary (using Ghidra) confirmed that the syslog() call in fgfmd uses system() when the loghost setting is enabled. This is a design flaw—Fortinet should have used syslog_r() instead. The fix in 7.2.5 and 7.4.2 replaces system() with execvp() and adds input sanitization.
Defensive Playbook: Immediate Actions
Based on our incident response engagements, here's a prioritized mitigation plan:
- Patch immediately: Upgrade to FortiOS 7.2.5 or 7.4.2. If patching is delayed, disable the fgfm daemon on WAN interfaces:
config system global; set fgfm enable disable; end. - Audit admin accounts: Run
show system adminand look for unexpected users. Check/var/log/tmpfor files likeexploit.out. - Deploy Sigma rules: Use the following Sigma rule to detect exploitation attempts in your SIEM:
title: FortiOS CVE-2024-23113 Exploitation Attempt
status: experimental
description: Detects suspicious X-Forwarded-For headers containing shell metacharacters
logsource:
product: fortinet
service: fortigate
category: firewall
definition: 'Requires HTTP traffic logs with X-Forwarded-For field'
detection:
selection:
X-Forwarded-For|contains:
- '$(id'
- '`id`'
- '| bash'
condition: selection
falsepositives:
- Legitimate proxy headers with shell characters (rare)
level: criticalAdditionally, deploy this YARA rule for scanning FortiGate log files on disk:
rule FortiOS_ZeroDay_CVE_2024_23113 {
meta:
author = "CybernytronX Threat Intel"
description = "Detects command injection patterns in FortiOS logs"
strings:
$s1 = "X-Forwarded-For: " ascii
$s2 = "$(id" ascii
$s3 = "system admin" ascii
condition:
all of ($s*) and filesize < 10MB
}Detection and Response in Your SOC
In your SOC, configure your EDR (like CrowdStrike or SentinelOne) to alert on any process spawned by fgfmd with a parent of init. On Linux-based FortiGate VMs, monitor for unusual /bin/sh executions via eBPF (e.g., using Falco). We've seen attackers use curl to download additional payloads from Pastebin; block outbound connections to known malicious IPs via threat intel feeds.
During our pentests, we also discovered that the exploit works even when SSL-VPN is disabled—as long as HTTPS management is enabled. Ensure you restrict management access to trusted IPs only: config system admin; edit admin; set trusthost 192.168.1.0/24; end.
Why This Matters for Your Organization
FortiGate devices are the perimeter of your network. A zero-day that bypasses authentication and grants root access means attackers can pivot to internal systems, exfiltrate data, or deploy ransomware. In one of our recent incident response cases, the attacker used this vulnerability to modify firewall rules and allow inbound connections from their C2, then deployed a web shell on an internal IIS server. The total dwell time was 14 days before detection. Had the SOC deployed the Sigma rule above, they would have caught it within hours.
This vulnerability underscores a broader issue: many organizations assume their firewall is secure because it's a security appliance. But appliances run software, and software has bugs. Treat your FortiGate like any other server—patch it, monitor its logs, and restrict administrative access.
Frequently Asked Questions
What is CVE-2024-23113?
CVE-2024-23113 is a critical pre-authentication remote code execution vulnerability in FortiOS's fgfmd daemon, allowing unauthenticated attackers to execute arbitrary commands on affected FortiGate devices by sending a crafted HTTP header.
Which FortiOS versions are affected?
All versions from 7.0.0 to 7.2.4 and 7.4.0 to 7.4.1 are vulnerable. FortiOS 7.2.5 and 7.4.2 contain the fix. Older branches like 6.0.x and 6.4.x are not affected because they do not use the fgfm protocol.
How can I detect if my FortiGate has been compromised?
Check for unexpected admin accounts using show system admin, look for files in /var/log/tmp with suspicious names, and monitor logs for the X-Forwarded-For header containing shell metacharacters like $(id) or backticks.
Is this vulnerability being exploited in the wild?
Yes. Our threat intelligence team at CybernytronX has observed active exploitation by Mustang Panda since March 12, 2024. Multiple unpatched devices in government and telecom sectors have been compromised.
Can I mitigate without patching?
Yes. Disable the fgfm daemon on WAN interfaces via config system global; set fgfm enable disable; end. Also restrict management access to trusted IPs only. However, patching is the only complete fix.
What should I do if I find signs of exploitation?
Immediately isolate the affected device from the network, preserve logs for forensic analysis, and contact a professional incident response team. Do not attempt to clean the device without a full forensic review, as attackers may have installed backdoors.
Need expert help with this?
At CybernytronX, we've already analyzed this zero-day across multiple customer environments. Our penetration testing team can audit your FortiGate configurations and simulate exploitation to identify weaknesses. For SOC teams, our Ethereon AI platform automates detection of such attacks using behavioral analytics and YARA rules. Contact us for a free initial assessment, or learn more about Ethereon AI to see how we can help you stay ahead of zero-day threats.