CVE-2024-33504: Fortinet FortiManager Info Disclosure Flaw

CVE-2024-33504 Overview

CVE-2024-33504 is a hard-coded cryptographic key vulnerability [CWE-321] affecting Fortinet FortiManager and FortiManager Cloud. The flaw allows an attacker holding JSON API access permissions to decrypt stored secrets, even when the private-data-encryption protection setting is enabled. The vulnerability spans FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9, and all 7.0 and 6.4 releases. Fortinet published the advisory FG-IR-24-094 addressing the issue.

Critical Impact
Attackers with authenticated JSON API access can bypass the private-data-encryption control and recover sensitive secrets stored on FortiManager.

Affected Products

Fortinet FortiManager 6.4 through 7.6.1 (see advisory for exact fixed versions)
Fortinet FortiManager Cloud (affected releases per vendor advisory)
Deployments relying on private-data-encryption to protect stored secrets

Discovery Timeline

2025-02-11 - CVE-2024-33504 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33504

Vulnerability Analysis

FortiManager centralizes configuration and secret material for managed Fortinet devices, including passwords, API tokens, and pre-shared keys. Operators enable private-data-encryption to encrypt these secrets so that credential material remains protected at rest.

CVE-2024-33504 undermines this protection. Fortinet's implementation reuses a cryptographic key embedded in the product rather than deriving keys strictly from the operator-supplied secret. An attacker with JSON API access permissions can therefore retrieve ciphertext through the API and decrypt selected secrets using the hard-coded key.

Exploitation requires network reachability to the JSON API and low-privileged authenticated access. No user interaction is needed, and the scope extends beyond the vulnerable component because recovered credentials can unlock managed downstream devices.

Root Cause

The root cause is the reuse of a static, product-embedded cryptographic key to encrypt sensitive fields. Because the key is identical across installations of the affected FortiManager versions, possession of the key or an implementation that accepts it as input breaks the confidentiality guarantee that private-data-encryption is meant to provide. This is a canonical CWE-321 (Use of Hard-Coded Cryptographic Key) weakness.

Attack Vector

Exploitation is network-based against the FortiManager JSON API. The attacker authenticates with an account that carries JSON API access permissions, queries objects that contain protected secret fields, and applies the hard-coded key to decrypt the returned ciphertext offline. Because FortiManager stores credentials for managed FortiGate and other Fortinet devices, successful decryption can pivot into administrative access on the broader Fortinet fleet.

No verified public exploit or proof-of-concept has been released. Technical details are documented in the Fortinet PSIRT advisory FG-IR-24-094 and the Orange CERT-CC GitHub advisory.

Detection Methods for CVE-2024-33504

Indicators of Compromise

Unexpected JSON API queries against object types that contain secrets, such as device credentials, VPN pre-shared keys, or SNMP community strings.
API sessions from low-privileged accounts pulling large volumes of encrypted secret fields in short windows.
Anomalous administrative logins on managed FortiGate devices shortly after suspicious FortiManager API activity.

Detection Strategies

Enable and centralize FortiManager audit logging, and alert on JSON API calls that read encrypted configuration attributes.
Baseline normal API consumer behavior per service account and flag deviations in call frequency, source IP, or object scope.
Correlate FortiManager API activity with authentication events on downstream managed devices to identify credential reuse.

Monitoring Recommendations

Forward FortiManager syslog and API logs to a central analytics platform for retention and correlation.
Track any account with rpc-permit or JSON API rights and review its access on a scheduled cadence.
Monitor for creation of new API-enabled administrators or permission changes on existing accounts.

How to Mitigate CVE-2024-33504

Immediate Actions Required

Upgrade FortiManager and FortiManager Cloud to the fixed releases listed in Fortinet advisory FG-IR-24-094.
Rotate all secrets stored in FortiManager, including device credentials, VPN pre-shared keys, and SNMP strings, after upgrading.
Review and prune accounts that hold JSON API permissions, and require strong authentication for remaining accounts.

Patch Information

Fortinet released fixed builds for the affected 7.6, 7.4, and 7.2 branches. Versions 7.0 and 6.4 are affected across all releases; consult the vendor advisory for the upgrade path. Because the vulnerability compromises stored secret confidentiality, patching alone is not sufficient - operators must also rotate any secrets that were held on the appliance before the upgrade.

Workarounds

Restrict JSON API access to a minimal set of administrative source networks using trusted host restrictions.
Remove rpc-permit and JSON API rights from any administrator account that does not strictly require them.
Segment the FortiManager management interface from general user networks and enforce multi-factor authentication for administrators.

bash

# Example: restrict JSON API access to trusted management hosts
config system admin user
    edit "api_user"
        set trusthost1 10.10.0.0 255.255.255.0
        set rpc-permit none
    next
end