CVE-2024-23665: Fortinet FortiWeb Auth Bypass Vulnerability

CVE-2024-23665 Overview

CVE-2024-23665 is an improper authorization vulnerability [CWE-285] affecting Fortinet FortiWeb. The flaw allows an authenticated attacker to perform unauthorized Administrative Domain (ADOM) operations by sending crafted requests. Fortinet disclosed the issue in security advisory FG-IR-23-474.

Affected releases include FortiWeb 7.4.2 and below, 7.2.7 and below, 7.0.10 and below, 6.4.3 and below, and 6.3.23 and below. Successful exploitation enables cross-ADOM actions that should be restricted to authorized administrators, undermining the segmentation model FortiWeb uses to isolate tenants and management scopes.

Critical Impact
An authenticated attacker with low privileges can perform ADOM operations outside their assigned scope, breaking administrative segmentation and impacting confidentiality, integrity, and availability of managed web application policies.

Affected Products

Fortinet FortiWeb 7.4.0 through 7.4.2
Fortinet FortiWeb 7.2.0 through 7.2.7, 7.0.0 through 7.0.10
Fortinet FortiWeb 6.4.0 through 6.4.3, 6.3.0 through 6.3.23

Discovery Timeline

2024-06-03 - CVE-2024-23665 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23665

Vulnerability Analysis

FortiWeb uses Administrative Domains (ADOMs) to segment configuration, policies, and management responsibilities across tenants or business units. CVE-2024-23665 stems from missing authorization checks on ADOM-scoped operations exposed through the management interface.

An authenticated administrator confined to one ADOM can craft requests that operate against ADOMs outside their assigned scope. The server accepts the ADOM identifier from the request without verifying that the caller's role grants access to that target. This breaks the tenancy boundary FortiWeb enforces for delegated administration.

The attack requires network access to the management interface and valid credentials. No user interaction is needed, and the complexity is low. Successful exploitation impacts confidentiality, integrity, and availability of policies and configuration managed under the targeted ADOMs.

Root Cause

The root cause is improper authorization [CWE-285] in the request handlers that process ADOM operations. The application authenticates the session but does not consistently validate that the authenticated principal owns the ADOM referenced in the request payload or URL.

Attack Vector

An attacker holding low-privilege credentials on a FortiWeb appliance sends crafted HTTP or HTTPS requests to the management interface. The requests reference an ADOM outside the attacker's assigned scope. Because the authorization check is incomplete, the server executes the requested operation against the unauthorized ADOM. No verified public proof-of-concept is available at the time of writing.

Detection Methods for CVE-2024-23665

Indicators of Compromise

Administrative actions in FortiWeb audit logs referencing ADOMs that the acting administrator is not assigned to manage.
Unexpected policy, server pool, or virtual server changes appearing in ADOMs shortly after low-privilege administrator logins.
Repeated HTTP requests to ADOM-scoped management endpoints from a single authenticated session enumerating multiple ADOM identifiers.

Detection Strategies

Correlate FortiWeb audit logs with administrator role assignments to flag any action executed against an ADOM outside the operator's scope.
Baseline normal administrator behavior per ADOM and alert on deviations, particularly configuration writes from accounts that historically only read.
Enable verbose logging on the management interface and forward events to a SIEM for cross-session correlation.

Monitoring Recommendations

Ship FortiWeb management and audit logs to a centralized log platform with role-to-ADOM mapping enriched at ingest.
Alert on administrator API calls that modify ADOM membership, policies, or user accounts outside business hours.
Monitor for privilege changes and new administrator account creation in any ADOM following a suspicious session.

How to Mitigate CVE-2024-23665

Immediate Actions Required

Upgrade FortiWeb to a fixed release as listed in Fortinet advisory FG-IR-23-474.
Restrict management interface access to trusted administrative networks and jump hosts only.
Audit existing administrator accounts and remove or downgrade unused, shared, or over-privileged accounts.
Rotate credentials for any administrator account that may have been exposed prior to patching.

Patch Information

Fortinet has published fixed builds and upgrade guidance in the Fortinet Security Advisory FG-IR-23-474. Administrators should follow the advisory to identify the corresponding fixed version for their deployed FortiWeb branch and plan an upgrade window.

Workarounds

Limit the number of administrators with ADOM access and enforce least-privilege role assignments.
Require multi-factor authentication for all FortiWeb administrator accounts to raise the cost of credential compromise.
Place the FortiWeb management interface behind a VPN or dedicated management network to reduce exposure until patching is complete.

bash

# Example: restrict FortiWeb management access to a trusted subnet
config system interface
  edit port1
    set allowaccess https ssh
    set trusthost1 10.10.0.0 255.255.255.0
  next
end