CVE-2024-23104: Fortinet Information Disclosure Flaw

CVE-2024-23104 Overview

CVE-2024-23104 is a sensitive information exposure vulnerability affecting Fortinet FortiNDR and FortiVoice products. This vulnerability allows a remote authenticated attacker with at least read-only permission on system maintenance to access backup information via crafted HTTP requests. The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper handling of access controls around sensitive backup data.

Critical Impact

Authenticated attackers with minimal privileges can exfiltrate sensitive backup information from affected Fortinet security appliances, potentially exposing configuration data, credentials, and network architecture details.

Affected Products

• Fortinet FortiNDR 7.6.0
• Fortinet FortiNDR 7.4.0 through 7.4.8
• Fortinet FortiNDR 7.2 all versions
• Fortinet FortiNDR 7.1 all versions
• Fortinet FortiNDR 7.0 all versions
• Fortinet FortiVoice 7.0.0 through 7.0.1

Discovery Timeline

• 2026-04-14 - CVE-2024-23104 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2024-23104

Vulnerability Analysis

This information exposure vulnerability stems from insufficient access control validation in the system maintenance functionality of affected Fortinet products. The vulnerability allows authenticated users with read-only permissions to access backup information that should be restricted to higher-privileged administrators. Network Detection and Response (NDR) appliances like FortiNDR typically contain highly sensitive security configurations, network topology information, and potentially stored credentials, making unauthorized backup access particularly concerning from a security perspective.

The attack requires network access and authentication with minimal privileges (read-only on system maintenance), but does not require user interaction to exploit. Successful exploitation could result in unauthorized access to confidential information and potential integrity impacts to the affected system.

Root Cause

The root cause of CVE-2024-23104 lies in improper authorization checks within the HTTP request handling mechanism for backup operations. The application fails to properly validate that the authenticated user has sufficient privileges to access backup data, allowing users with only read-only permissions to retrieve sensitive backup information through specially crafted HTTP requests.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an authenticated session with the target FortiNDR or FortiVoice appliance. An attacker must first obtain valid credentials with at least read-only access to the system maintenance interface. Once authenticated, the attacker can craft specific HTTP requests to the backup functionality endpoint that bypass the intended authorization controls, allowing retrieval of backup data containing sensitive configuration and potentially credential information.

The vulnerability exploits insufficient privilege verification in the backup access mechanism. When a crafted HTTP request is sent to the system maintenance backup endpoint, the application fails to verify that the requesting user has write or administrative permissions typically required for backup operations.

Detection Methods for CVE-2024-23104

Indicators of Compromise

• Unusual HTTP requests targeting backup-related endpoints from accounts with read-only permissions
• Unexpected access to system maintenance backup functionality by non-administrative users
• Anomalous data exfiltration patterns from FortiNDR or FortiVoice management interfaces
• Authentication logs showing read-only accounts accessing privileged backup resources

Detection Strategies

• Monitor FortiNDR and FortiVoice access logs for unusual backup access patterns from low-privileged accounts
• Implement network traffic analysis to detect large data transfers from management interfaces
• Configure alerting for any access to backup endpoints by accounts without administrative privileges
• Review HTTP request logs for crafted or malformed requests targeting system maintenance functions

Monitoring Recommendations

• Enable verbose logging on FortiNDR and FortiVoice system maintenance modules
• Implement real-time alerting for backup access attempts by non-administrative accounts
• Regularly audit user permissions to ensure principle of least privilege is maintained
• Deploy network monitoring to detect potential data exfiltration from security appliance management interfaces

How to Mitigate CVE-2024-23104

Immediate Actions Required

• Review and restrict read-only account permissions on all affected FortiNDR and FortiVoice appliances
• Audit all user accounts with system maintenance access and remove unnecessary permissions
• Apply vendor patches as they become available from Fortinet
• Implement network segmentation to limit management interface access to trusted administrators only

Patch Information

Fortinet has released a security advisory addressing this vulnerability. Administrators should consult the Fortinet Security Advisory FG-IR-26-124 for specific patch information and updated firmware versions that address CVE-2024-23104. It is recommended to upgrade to the latest supported version of FortiNDR and FortiVoice that contains the security fix.

Workarounds

• Restrict network access to FortiNDR and FortiVoice management interfaces to trusted IP addresses only
• Disable or remove read-only accounts that do not require system maintenance access
• Implement additional authentication controls such as multi-factor authentication for management access
• Monitor and log all access to system maintenance functionality until patches can be applied

# Example: Restrict management access to trusted networks (adjust for your environment)
# FortiNDR CLI configuration example
config system interface
    edit "mgmt"
        set allowaccess ping https ssh
        set trusted-hosts 10.0.0.0/24 192.168.1.0/24
    next
end