Fortinet FortiOS and related products: Format string vulnerability in FGFM service (CVE-2024-23113)

CVE-2024-23113 is a critical format string vulnerability affecting the FortiGate FGFM (FortiGate to FortiManager) protocol service. The service, which facilitates management communication, listens on TCP port 541. Improper handling of input strings allows an unauthenticated attacker to inject format specifiers, such as %n, which may result in remote code execution (RCE) or denial-of-service due to memory corruption. Public exploit code is available that targets this service by sending malformed payloads and monitoring for service-level SSL alerts or connection resets indicative of an exploit attempt.

Impact

The vulnerability is rated at CVSS 9.8. Successful exploitation enables unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. Exposure is increased due to the availability of functional proof-of-concept exploit scripts.

Recommendation

1. Inventory all internet-facing FortiGate, Fortiproxy, Fortiswitchmanager, and Fortipam assets.
2. Restrict access to TCP port 541 (FGFM) to trusted management IP addresses only.
3. Apply vendor-provided security patches immediately to address the vulnerability in the affected versions of FortiOS, Fortiproxy, Fortiswitchmanager, and Fortipam.
4. Implement network-level monitoring to detect anomalous traffic patterns targeting port 541, specifically patterns containing common format string specifiers.