CVE-2024-21753: FortiClientEMS Path Traversal Vulnerability

CVE-2024-21753 Overview

CVE-2024-21753 is a path traversal vulnerability (CWE-22) affecting Fortinet FortiClientEMS, an endpoint management server used to centrally manage FortiClient endpoints across enterprise environments. The vulnerability allows an attacker to escape the intended directory structure through improper limitation of a pathname to a restricted directory.

This flaw enables attackers to craft specially designed HTTP requests that can traverse directory paths, potentially leading to denial of service conditions, unauthorized file reads, or writing to a limited number of files on the affected system.

Critical Impact

Authenticated attackers can exploit this path traversal vulnerability to perform denial of service attacks, read sensitive configuration files, or write to restricted files on FortiClientEMS servers, potentially compromising the management infrastructure for enterprise endpoints.

Affected Products

• Fortinet FortiClientEMS versions 7.2.0 through 7.2.4
• Fortinet FortiClientEMS versions 7.0.0 through 7.0.13
• Fortinet FortiClientEMS versions 6.4.0 through 6.4.9
• Fortinet FortiClientEMS versions 6.2.0 through 6.2.9
• Fortinet FortiClientEMS versions 6.0.0 through 6.0.8
• Fortinet FortiClientEMS versions 1.2.1 through 1.2.5

Discovery Timeline

• September 10, 2024 - CVE-2024-21753 published to NVD
• September 25, 2024 - Last updated in NVD database

Technical Details for CVE-2024-21753

Vulnerability Analysis

This path traversal vulnerability exists in the HTTP request handling mechanism of FortiClientEMS. The vulnerability occurs when the application fails to properly sanitize user-supplied input used to construct file paths. An attacker with high privileges (authenticated access) can exploit this weakness to access files and directories outside the intended web root or application directory.

The attack is network-accessible and requires no user interaction, though it does require authenticated access with elevated privileges to the FortiClientEMS interface. The impact includes potential confidentiality breaches through file reads, integrity violations through limited file writes, and high availability impact through denial of service conditions.

Root Cause

The root cause of CVE-2024-21753 is improper input validation in the file path handling logic of FortiClientEMS. The application fails to adequately filter or neutralize special elements (such as ../ sequences) in user-supplied input before using it to construct file paths. This allows attackers to use directory traversal sequences to navigate outside the intended directory structure.

Attack Vector

The attack vector is network-based, requiring authenticated access to the FortiClientEMS management interface. An attacker can craft malicious HTTP requests containing path traversal sequences to:

1. Navigate outside the application's intended directory structure
2. Read configuration files, logs, or other sensitive data from the system
3. Write to a limited set of files, potentially corrupting configurations
4. Cause denial of service by accessing or manipulating critical system files

The vulnerability is exploited by embedding directory traversal sequences like ../ or ..\\ within HTTP request parameters that are used for file operations. When the application processes these requests without proper sanitization, it inadvertently accesses files outside the intended scope.

Detection Methods for CVE-2024-21753

Indicators of Compromise

• HTTP requests containing path traversal sequences such as ../, ..\\, %2e%2e%2f, or %2e%2e/ targeting FortiClientEMS endpoints
• Unusual file access patterns in FortiClientEMS logs, particularly access to files outside the web application directory
• Error messages or log entries indicating failed attempts to access system files or directories
• Unexpected changes to configuration files on the FortiClientEMS server

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns
• Monitor FortiClientEMS access logs for requests with encoded or plaintext directory traversal sequences
• Deploy file integrity monitoring on critical FortiClientEMS directories to detect unauthorized modifications
• Configure SIEM rules to alert on multiple failed file access attempts from single sources

Monitoring Recommendations

• Enable detailed logging on FortiClientEMS servers and forward logs to a centralized SIEM solution
• Monitor network traffic for unusual patterns targeting FortiClientEMS management ports
• Implement anomaly detection for file system access patterns on FortiClientEMS servers
• Regularly audit user accounts with administrative access to FortiClientEMS to ensure least privilege principles

How to Mitigate CVE-2024-21753

Immediate Actions Required

• Review the Fortinet Security Advisory FG-IR-23-362 for specific patch information and update FortiClientEMS to a patched version immediately
• Restrict network access to FortiClientEMS management interfaces using firewall rules and network segmentation
• Audit administrative accounts with access to FortiClientEMS and remove unnecessary privileges
• Enable enhanced logging and monitoring on affected FortiClientEMS servers until patches can be applied

Patch Information

Fortinet has released security updates to address this vulnerability. Organizations should consult the Fortinet Security Advisory FG-IR-23-362 for specific version information and upgrade paths. The advisory provides detailed guidance on which versions contain the fix for each affected product branch.

Administrators should upgrade to the latest available version within their deployment branch:

• FortiClientEMS 7.2.x: Upgrade to version 7.2.5 or later
• FortiClientEMS 7.0.x: Upgrade to version 7.0.14 or later
• Legacy versions (6.x and 1.2.x): Consider upgrading to a supported version branch

Workarounds

• Implement network access controls to limit FortiClientEMS management access to trusted administrative networks only
• Deploy a web application firewall (WAF) in front of FortiClientEMS to filter requests containing path traversal patterns
• Reduce the attack surface by disabling any unnecessary HTTP endpoints or services on FortiClientEMS
• Apply principle of least privilege to all accounts with FortiClientEMS administrative access

# Example: Restrict access to FortiClientEMS management interface using firewall rules
# Allow only trusted management networks
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Enable logging for connection attempts
iptables -A INPUT -p tcp --dport 443 -j LOG --log-prefix "FortiClientEMS-Access: "