CVE-2024-23105: Fortinet FortiPortal Auth Bypass Flaw

CVE-2024-23105 Overview

CVE-2024-23105 is a Use of Less Trusted Source vulnerability [CWE-348] affecting Fortinet FortiPortal. The flaw permits an unauthenticated attacker to bypass IP protection controls by sending crafted HTTP or HTTPS packets. Affected releases include FortiPortal versions 7.0.0 through 7.0.6 and 7.2.0 through 7.2.1. Fortinet published the advisory through its FortiGuard PSIRT on May 14, 2024.

Critical Impact
An unauthenticated remote attacker can circumvent IP-based access restrictions in FortiPortal, exposing the management interface to sources that administrators intended to block.

Affected Products

Fortinet FortiPortal 7.0.0 through 7.0.6
Fortinet FortiPortal 7.2.0 through 7.2.1
FortiPortal management interfaces exposed over HTTP/HTTPS

Discovery Timeline

2024-05-14 - CVE-2024-23105 published to the National Vulnerability Database
2024-05-14 - Fortinet publishes advisory FG-IR-24-021
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23105

Vulnerability Analysis

The vulnerability originates in how FortiPortal determines the client IP address when enforcing IP-based access controls. FortiPortal relies on data from a less trusted source, such as HTTP request headers, rather than the authenticated transport-layer source address. Attackers can supply header values that misrepresent their origin, causing the application to evaluate access policies against attacker-controlled input.

The result is a bypass of IP allow-list and deny-list protections. Requests that should be dropped based on network policy reach the application layer and are processed as if they originated from trusted addresses. This exposes administrative and API surfaces to untrusted networks.

The issue is exploitable over the network without authentication or user interaction. The EPSS probability for this CVE is 0.445%.

Root Cause

The root cause is trust placed in client-supplied HTTP header fields, commonly X-Forwarded-For or similar proxy headers, to identify the true source of a request. When FortiPortal sits behind or is configured to accept these headers, the application accepts attacker-crafted values without validation against the actual TCP peer. This pattern is classified under CWE-348 (Use of Less Trusted Source).

Attack Vector

An attacker sends an HTTP or HTTPS request directly to FortiPortal from any network-reachable location. The request contains forged header values that mimic a permitted internal or trusted IP address. FortiPortal parses the header, applies IP filtering against the spoofed value, and permits the request to proceed. The attacker then interacts with functionality that should have been restricted to the trusted network range.

No verified public exploit is available. The vulnerability is described in prose based on the Fortinet advisory; see FortiGuard PSIRT FG-IR-24-021 for vendor detail.

Detection Methods for CVE-2024-23105

Indicators of Compromise

HTTP or HTTPS requests to FortiPortal containing X-Forwarded-For, X-Real-IP, or similar proxy headers from clients that are not legitimate upstream proxies.
Access log entries showing successful authentication or API activity from external TCP peers where the logged application-level IP claims to be internal.
Repeated administrative endpoint access attempts from source addresses not previously seen in baseline traffic.

Detection Strategies

Compare the transport-layer source IP recorded by the reverse proxy or load balancer to the application-layer IP logged by FortiPortal, and alert on mismatches.
Deploy web application firewall rules that strip or normalize forwarding headers on inbound traffic that does not traverse an approved proxy.
Hunt for requests where forwarding headers contain RFC1918 addresses received on internet-facing listeners.

Monitoring Recommendations

Forward FortiPortal access and audit logs to a central SIEM and retain them for correlation.
Baseline the set of source IPs that legitimately reach the management interface, then alert on deviations.
Monitor Fortinet PSIRT advisories for updates to FG-IR-24-021.

How to Mitigate CVE-2024-23105

Immediate Actions Required

Upgrade FortiPortal to a fixed release as documented in the Fortinet advisory FG-IR-24-021.
Restrict network reachability of FortiPortal management interfaces to trusted administrative networks at the firewall layer, independent of application-level IP filtering.
Audit historical access logs for requests that carried unexpected forwarding headers.

Patch Information

Fortinet released patched versions of FortiPortal that address CVE-2024-23105. Consult FortiGuard PSIRT FG-IR-24-021 for the exact fixed builds corresponding to the 7.0.x and 7.2.x branches and follow the vendor upgrade path.

Workarounds

Terminate client connections at a reverse proxy that overwrites, rather than appends to, forwarding headers before they reach FortiPortal.
Enforce IP allow-listing at a network firewall or load balancer using the true transport-layer source address rather than relying on FortiPortal's application-layer filtering.
Disable or restrict external exposure of the FortiPortal management interface until patching is complete.

bash

# Example: strip client-supplied forwarding headers at an nginx reverse proxy
location / {
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass https://fortiportal.internal;
}