CVE-2024-23664 Overview
CVE-2024-23664 is an open redirect vulnerability [CWE-601] in Fortinet FortiAuthenticator. The flaw affects FortiAuthenticator version 6.6.0, versions 6.5.3 and below, and versions 6.4.9 and below. An attacker can craft a malicious URL that redirects authenticated or unauthenticated users to an arbitrary external website. The vulnerability requires user interaction to trigger, typically through a phishing lure that presents the crafted link. Fortinet published the advisory FG-IR-23-465 documenting the issue and providing fixed versions.
Critical Impact
Attackers can weaponize FortiAuthenticator URLs to redirect victims to attacker-controlled sites, enabling credential phishing and malware delivery campaigns that appear to originate from a trusted identity management platform.
Affected Products
- Fortinet FortiAuthenticator 6.6.0
- Fortinet FortiAuthenticator 6.5.3 and below
- Fortinet FortiAuthenticator 6.4.9 and below
Discovery Timeline
- 2024-06-03 - CVE-2024-23664 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23664
Vulnerability Analysis
FortiAuthenticator is Fortinet's centralized authentication server providing identity and access management services. The vulnerability resides in URL handling logic that accepts a redirect target parameter without validating that the destination points to an approved host. An attacker constructs a URL using the legitimate FortiAuthenticator domain but embeds an external redirect target in a query parameter. When a victim clicks the link, the FortiAuthenticator server issues an HTTP redirect to the attacker-supplied location.
The vulnerability delivers low confidentiality and integrity impact on its own. Its practical severity comes from the trust users place in the FortiAuthenticator hostname, which is often bookmarked or referenced in official IT communications. Because the redirect crosses a trust boundary, the CVSS scope is marked as changed.
Root Cause
The root cause is insufficient validation of user-supplied input used to construct a redirect response. The application does not enforce an allowlist of permitted redirect destinations and does not restrict redirects to same-origin URLs. Any URL supplied through the vulnerable parameter is honored by the server.
Attack Vector
Exploitation requires an attacker to deliver a crafted URL to a target user through email, chat, or another communication channel. The URL uses the trusted FortiAuthenticator domain in the visible portion and encodes an attacker-controlled destination in a redirect parameter. When clicked, the server responds with a redirect to the attacker's site, which typically hosts a spoofed FortiAuthenticator login page for credential harvesting or a malware distribution point.
See the Fortinet Security Advisory FG-IR-23-465 for vendor-supplied technical details.
Detection Methods for CVE-2024-23664
Indicators of Compromise
- HTTP requests to FortiAuthenticator endpoints containing redirect parameters that reference external domains
- Server access logs showing 3xx redirect responses with Location headers pointing to non-Fortinet hosts
- User reports of unexpected redirects from FortiAuthenticator login pages to unfamiliar sites
- Phishing emails that reference the organization's FortiAuthenticator URL with unusual query strings
Detection Strategies
- Inspect web proxy and firewall logs for outbound requests originating from FortiAuthenticator redirects to untrusted domains
- Parse FortiAuthenticator access logs for query parameters containing fully qualified URLs or URL-encoded protocol schemes
- Correlate email gateway telemetry with URL patterns matching the FortiAuthenticator hostname followed by redirect parameters
Monitoring Recommendations
- Enable verbose HTTP request logging on FortiAuthenticator and forward logs to a centralized analytics platform
- Alert on any FortiAuthenticator response with a Location header whose host does not match approved internal or Fortinet domains
- Monitor user-reported phishing submissions for links referencing FortiAuthenticator URLs
How to Mitigate CVE-2024-23664
Immediate Actions Required
- Upgrade FortiAuthenticator to a fixed version as specified in advisory FG-IR-23-465
- Inventory all FortiAuthenticator instances, including those in disaster recovery or lab environments, and confirm patch status
- Educate users about phishing techniques that abuse trusted domains through open redirects
Patch Information
Fortinet has released patched versions of FortiAuthenticator that address CVE-2024-23664. Refer to the Fortinet Security Advisory FG-IR-23-465 for the complete list of fixed versions and upgrade guidance. Apply the update through the standard FortiAuthenticator upgrade process during a scheduled maintenance window.
Workarounds
- Restrict access to the FortiAuthenticator management and portal interfaces to trusted network segments where feasible
- Deploy a web application firewall rule that strips or blocks external URLs in redirect parameters targeting FortiAuthenticator endpoints
- Configure email security controls to flag or rewrite URLs that combine the FortiAuthenticator hostname with suspicious query parameters
# Example WAF rule concept to block external redirect targets
# Reject requests to FortiAuthenticator where a redirect parameter contains an external scheme
SecRule REQUEST_URI "@rx (redirect|url|next|return)=https?%3A%2F%2F(?!fortiauthenticator\.example\.com)" \
"id:1002301,phase:1,deny,status:400,msg:'Blocked external open redirect attempt (CVE-2024-23664)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
