CVE-2024-26006: Fortinet FortiOS XSS Vulnerability

CVE-2024-26006 Overview

CVE-2024-26006 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the SSL VPN web UI of Fortinet FortiOS and FortiProxy. The flaw stems from improper neutralization of input during web page generation. A remote unauthenticated attacker can trigger the vulnerability by luring a victim to interact with a malicious Samba server. Successful exploitation allows the attacker to execute arbitrary script in the victim's browser context, potentially leading to session compromise or content manipulation within the SSL VPN portal.

Critical Impact
Remote unauthenticated attackers can execute arbitrary JavaScript in an authenticated user's browser session by routing SSL VPN interactions through a malicious Samba server.

Affected Products

Fortinet FortiOS versions 7.4.3 and below, 7.2.7 and below, and 7.0.13 and below
Fortinet FortiProxy versions 7.4.3 and below, 7.2.9 and below, and 7.0.16 and below
SSL VPN web UI component in both product lines

Discovery Timeline

2025-03-14 - CVE-2024-26006 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26006

Vulnerability Analysis

The vulnerability resides in the SSL VPN web UI component of FortiOS and FortiProxy. The affected code path fails to sanitize data returned from remote Samba (SMB) servers before rendering it in the browser. When a user accesses a Samba share through the SSL VPN portal, attacker-controlled content, such as file names or share metadata, is reflected into the UI without proper encoding. A browser then interprets the injected payload as executable script.

The attack requires user interaction, since a victim must access an attacker-controlled Samba resource through the portal. Because the payload executes in the origin of the SSL VPN UI, it can access session context, initiate requests to backend endpoints, and manipulate rendered content visible to the user.

Root Cause

The root cause is missing or insufficient output encoding when the SSL VPN UI renders content sourced from external SMB servers. Fortinet categorizes the issue under CWE-79: Improper Neutralization of Input During Web Page Generation. Trust in server-supplied strings, without treating them as untrusted input, enables the injection.

Attack Vector

Exploitation follows this sequence:

The attacker operates or compromises a Samba server hosting resources with crafted, script-bearing metadata.
A user authenticated to the SSL VPN portal browses to the attacker-controlled SMB share through the portal's file-access feature.
The FortiOS or FortiProxy web UI renders the attacker-controlled strings without adequate sanitization.
The victim's browser executes the injected JavaScript within the SSL VPN portal's origin.

No prior authentication to the affected device is required from the attacker. See the Fortinet PSIRT Advisory FG-IR-23-485 for vendor technical details.

// No verified public proof-of-concept is available for CVE-2024-26006.
// See the Fortinet PSIRT advisory FG-IR-23-485 for vendor guidance.

Detection Methods for CVE-2024-26006

Indicators of Compromise

SSL VPN sessions initiating SMB connections to untrusted or newly observed external Samba servers
Unusual outbound HTTP requests from user browsers immediately following SSL VPN SMB file-browse activity
Anomalous script-like tokens (<script>, onerror=, javascript:) appearing in FortiOS SSL VPN access or proxy logs referencing SMB resource names

Detection Strategies

Inspect FortiOS SSL VPN logs for file-browse requests targeting external SMB endpoints outside approved internal ranges
Monitor web proxy telemetry for unexpected script execution or DOM-based requests originating from the SSL VPN portal domain
Correlate SSL VPN user sessions with downstream browser activity to identify session-hijacking indicators such as unexpected API calls or token exfiltration

Monitoring Recommendations

Enable verbose logging on the SSL VPN gateway and forward events to a centralized SIEM for retention and correlation
Alert on SMB share access initiated through the SSL VPN portal to hosts outside the enterprise perimeter
Baseline normal SSL VPN portal behavior and alert on deviations such as new outbound domains contacted from the portal origin

How to Mitigate CVE-2024-26006

Immediate Actions Required

Upgrade FortiOS and FortiProxy to fixed versions as identified in the Fortinet PSIRT Advisory FG-IR-23-485
Restrict SSL VPN users from accessing untrusted external SMB servers through portal file-share features
Review SSL VPN portal configuration and disable SMB/CIFS bookmarks that reference non-enterprise hosts

Patch Information

Fortinet has released fixed builds for the affected FortiOS and FortiProxy branches. Administrators should consult Fortinet PSIRT Advisory FG-IR-23-485 for the specific patched version applicable to their deployment and follow standard Fortinet upgrade procedures.

Workarounds

Disable the SSL VPN web mode file-browse functionality if upgrading is not immediately possible
Enforce strict egress filtering to block SMB traffic from the SSL VPN gateway to untrusted destinations
Educate SSL VPN users to avoid opening unfamiliar SMB bookmarks or links delivered through phishing

bash

# Example: disable SSL VPN web mode on affected FortiGate (adjust to environment)
config vpn ssl settings
    set web-mode disable
end