CVE-2024-33510: Fortinet FortiProxy XSS Vulnerability

CVE-2024-33510 Overview

CVE-2024-33510 is an injection vulnerability [CWE-74] affecting the SSL-VPN web user interface in multiple Fortinet products. The flaw results from improper neutralization of special elements passed to a downstream component. A remote unauthenticated attacker can craft requests that enable phishing attempts against users of the SSL-VPN portal.

The vulnerability affects FortiOS, FortiProxy, and FortiSASE. Successful exploitation requires user interaction, limiting its direct impact to social-engineering scenarios rather than full system compromise.

Critical Impact
A remote unauthenticated attacker can craft requests against the SSL-VPN web interface to facilitate phishing attempts against legitimate users.

Affected Products

FortiOS versions 7.4.3 and below, 7.2.8 and below, and 7.0.16 and below
FortiProxy versions 7.4.3 and below, 7.2.9 and below, and 7.0.16 and below
FortiSASE version 24.2.b

Discovery Timeline

2024-11-12 - CVE-2024-33510 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33510

Vulnerability Analysis

The vulnerability resides in the SSL-VPN web user interface component shared across FortiOS, FortiProxy, and FortiSASE. Input supplied through crafted HTTP requests is passed to a downstream component without adequate neutralization of special characters. The downstream component then processes attacker-controlled content in a context where it can influence rendered output or application behavior.

The practical impact centers on phishing. An attacker can construct URLs or requests that cause the SSL-VPN portal to display attacker-influenced content to victims, lending credibility to credential-harvesting pages served through or alongside the trusted VPN hostname.

Success requires the victim to interact with the crafted request, typically by clicking a malicious link. No authentication is required to initiate the attack, which increases its utility in targeted phishing campaigns against enterprises exposing SSL-VPN portals to the internet.

Root Cause

The root cause is improper neutralization of special elements in output used by a downstream component [CWE-74], specifically within the SSL-VPN web UI request handling. Fortinet's advisory also references [CWE-358] (improperly implemented security check for standard). The affected code paths do not sanitize input to the standard required before handing it to the rendering component.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL targeting the exposed SSL-VPN web interface and delivers it through email, messaging, or a watering-hole page. When a victim loads the URL, the portal processes the attacker-controlled input and renders content that supports a phishing scenario on a trusted domain.

See the Fortinet Security Advisory FG-IR-24-033 for vendor-specific technical details.

Detection Methods for CVE-2024-33510

Indicators of Compromise

Inbound HTTP(S) requests to SSL-VPN portal URLs containing unusual query parameters, encoded payloads, or unexpected special characters.
External referrers pointing SSL-VPN users to the portal from unknown or newly registered domains.
User reports of credential prompts or unexpected content appearing on the SSL-VPN login page.

Detection Strategies

Review web application firewall (WAF) and reverse proxy logs for anomalous parameter values targeting the SSL-VPN login endpoints.
Correlate SSL-VPN portal access logs with email security telemetry to identify clicks originating from phishing campaigns.
Deploy content inspection on outbound mail gateways to flag links referencing the organization's VPN hostname with suspicious parameters.

Monitoring Recommendations

Enable verbose HTTP logging on FortiOS and FortiProxy devices and forward events to a central SIEM for analysis.
Alert on spikes in SSL-VPN login page requests from a single external source or geographic region.
Monitor authentication telemetry for failed logins immediately following access to crafted portal URLs.

How to Mitigate CVE-2024-33510

Immediate Actions Required

Upgrade affected FortiOS, FortiProxy, and FortiSASE instances to fixed versions as listed in the Fortinet PSIRT advisory.
Restrict SSL-VPN portal exposure to known IP ranges or geographic regions where feasible.
Educate SSL-VPN users on verifying portal URLs and reporting suspicious login pages.

Patch Information

Fortinet has released fixed versions for the affected product lines. Refer to Fortinet Security Advisory FG-IR-24-033 for the full list of fixed versions and upgrade guidance across FortiOS 7.4.x, 7.2.x, 7.0.x, FortiProxy 7.4.x, 7.2.x, 7.0.x, and FortiSASE.

Workarounds

Disable the SSL-VPN web interface if remote access is not required, or restrict it to IPsec VPN only.
Place SSL-VPN portals behind a WAF configured to reject requests containing unexpected special characters in query strings.
Apply geographic and source-IP restrictions on the SSL-VPN listener until patches are deployed.

bash

# Example: disable SSL-VPN web mode until patched (FortiOS CLI)
config vpn ssl settings
    set web-mode disable
end