CVE-2024-35273: Fortinet FortiAnalyzer Privilege Escalation

CVE-2024-35273 Overview

CVE-2024-35273 is an out-of-bounds write vulnerability affecting Fortinet FortiManager and FortiAnalyzer versions 7.4.0 through 7.4.2. The flaw allows an authenticated attacker to escalate privileges by sending specially crafted HTTP requests to the management interface. The vulnerability is tracked under CWE-787 and is documented in Fortinet Security Advisory FG-IR-24-106.

Critical Impact
Successful exploitation grants attackers elevated privileges on FortiManager or FortiAnalyzer appliances, which centrally manage security policies and log data across Fortinet fabric deployments.

Affected Products

Fortinet FortiManager versions 7.4.0 through 7.4.2 (including FortiManager Cloud)
Fortinet FortiAnalyzer versions 7.4.0 through 7.4.2 (including FortiAnalyzer Cloud)
Deployments exposing the HTTP administrative interface to untrusted networks

Discovery Timeline

2025-01-14 - CVE-2024-35273 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35273

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in the HTTP request handling logic of FortiManager and FortiAnalyzer. When the affected daemon parses specially crafted HTTP requests, it writes data past the allocated buffer boundary. This memory corruption condition can be manipulated to influence adjacent memory structures used for authorization decisions.

An attacker with low-level privileges on the appliance can leverage this flaw to escalate to higher privileges. FortiManager and FortiAnalyzer are central management and logging platforms in Fortinet deployments, so compromising them provides visibility and control over connected FortiGate devices and policy data.

The attack vector is network-based and requires low attack complexity. The EPSS probability sits at roughly 0.66 percent, indicating limited but non-trivial exploitation interest at this time.

Root Cause

The root cause is improper validation of length or index values when writing data into a fixed-size buffer during HTTP request processing. Without adequate bounds checking, attacker-controlled input overwrites memory beyond the intended destination. Fortinet has not published low-level technical details about the affected component or function.

Attack Vector

Exploitation requires network access to the management interface and authenticated access at low privilege. The attacker submits crafted HTTP requests containing payloads that trigger the out-of-bounds write during parsing. No user interaction is required, and successful exploitation results in privilege escalation on the target appliance.

No public proof-of-concept code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Fortinet Security Advisory FG-IR-24-106 for authoritative vendor guidance.

Detection Methods for CVE-2024-35273

Indicators of Compromise

Unexpected privilege escalations or new administrative accounts created on FortiManager or FortiAnalyzer appliances
Anomalous HTTP requests to management endpoints containing unusually long or malformed parameters
Crashes or restarts of management daemons captured in appliance system logs
Configuration changes or policy pushes not tied to authorized change tickets

Detection Strategies

Compare running FortiManager and FortiAnalyzer versions against the vulnerable range 7.4.0 through 7.4.2 using vulnerability management tooling
Inspect HTTP access logs for oversized request bodies, malformed headers, or repeated failed authentications preceding privilege changes
Correlate administrative account changes with authentication source IPs and administrator session records

Monitoring Recommendations

Forward FortiManager and FortiAnalyzer audit logs to a central SIEM or data lake for cross-appliance correlation
Alert on any modification to admin profiles, super_admin role membership, or trusted host configurations
Monitor network telemetry for connections to management interfaces originating from non-administrative subnets

How to Mitigate CVE-2024-35273

Immediate Actions Required

Upgrade FortiManager and FortiAnalyzer to version 7.4.3 or later as directed by Fortinet Security Advisory FG-IR-24-106
Restrict access to the management HTTP interface to trusted administrative networks only
Rotate credentials for all administrative accounts on affected appliances after patching
Review recent audit logs for privilege changes that predate the upgrade

Patch Information

Fortinet released fixed builds addressing this issue. Administrators should apply the vendor-supplied updates that move FortiManager and FortiAnalyzer beyond the vulnerable 7.4.0 through 7.4.2 range. Consult Fortinet Security Advisory FG-IR-24-106 for the exact fixed versions and upgrade paths for FortiManager Cloud and FortiAnalyzer Cloud tenants.

Workarounds

Limit trusted hosts on administrative accounts to specific management workstation IP addresses
Place management interfaces behind a jump host or VPN and block direct internet exposure
Disable unused administrative accounts and enforce multi-factor authentication for remaining administrators

bash

# Example: restrict administrator trusted hosts on FortiManager CLI
config system admin user
    edit "admin"
        set trusthost1 10.0.0.0 255.255.255.0
        set trusthost2 192.168.10.0 255.255.255.0
    next
end