Happy #ZeroDay from your friends at **Fortinet**: [Authentication bypass in Node.js websocket module](https://fortiguard.fortinet.com/psirt/FG-IR-24-535 )
CVE-2024-55591 (CVSSv3.1: **9.8 critical**) An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS and FortiProxy may allow a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
> Please note that reports show this is being exploited in the wild.
Indicators of compromise include possible log entries, IP addresses used, and admin accounts created. cc: Kevin Beaumont (npub1lcc…lcye) Will Dormann (npub12xh…zxeq) :rainbowCrow: (npub1s6e…n008) BrianKrebs (npub1vc3…axsh)
#zeroday #patchtuesday #fortinet #vulnerability #CVE_2024_55591 #infosec #ioc #threatintel #infosec #cybersecurity #
Not Simon 🐐
npub14g…xznd6
2025-01-14 14:26:32 UTC
Author Public Key
npub14g0mj0fmn0sepfuhp2wupyk7d8xyz7rezpmrx2gfsav9vxlwxypq4xznd6Seen on
wss://relay.momostr.pinkPublished at
2025-01-14 14:26:32 UTCEvent JSON
{
"id": "e5f1cf345a20234e47cb2b3c073c4302486d0bf0ce77138e78a34127d913ba24",
"pubkey": "aa1fb93d3b9be190a7970a9dc092de69cc41787910763329098758561bee3102",
"created_at": 1736864792,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@screaminggoat/113827171069136576",
"web"
],
[
"p",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"p",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"t",
"cve_2024_55591"
],
[
"p",
"51ae1009e4403d821fc1c12e14bf4b40de44c7dc6177898840ca1ef9f9ebc768"
],
[
"t",
"patchtuesday"
],
[
"t",
"fortinet"
],
[
"t",
"vulnerability"
],
[
"t",
"infosec"
],
[
"t",
"threatintel"
],
[
"p",
"662250ce4d037de109a64a6a0230f7899f922b76346388b3e7ca06fe9490358d"
],
[
"t",
"ioc"
],
[
"t",
"zeroday"
],
[
"t",
"cybersecurity"
],
[
"proxy",
"https://infosec.exchange/users/screaminggoat/statuses/113827171069136576",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/screaminggoat/statuses/113827171069136576",
"pink.momostr"
],
[
"-"
]
],
"content": "Happy #ZeroDay from your friends at **Fortinet**: [Authentication bypass in Node.js websocket module](https://fortiguard.fortinet.com/psirt/FG-IR-24-535 )\nCVE-2024-55591 (CVSSv3.1: **9.8 critical**) An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS and FortiProxy may allow a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.\n\n\u003e Please note that reports show this is being exploited in the wild.\n\nIndicators of compromise include possible log entries, IP addresses used, and admin accounts created. cc: nostr:npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcye nostr:npub12xhpqz0ygq7cy87pcyhpf06tgr0yf37uv9mcnzzqeg00n70tca5q0vzxeq nostr:npub1s6eewzr2zvz3ppsa6k8j2hadamsug7q4rp068wmz3grtf440xxkqr8n008 nostr:npub1vc39pnjdqd77zzdxff4qyv8h3x0ey2mkx33c3vl8egr0a9ysxkxsk0axsh \n\n#zeroday #patchtuesday #fortinet #vulnerability #CVE_2024_55591 #infosec #ioc #threatintel #infosec #cybersecurity #",
"sig": "9b4e3db17e69ff543097d1abbe934c4a4ede3061e79b972fc5b1a5b63066718c07f75e00d49df845b12f9c4432adedc8c9f0a94dfc18131dc3b30dca2ea048dd"
}