CVE-2024-35275: Fortinet FortiAnalyzer SQLi Vulnerability

CVE-2024-35275 Overview

CVE-2024-35275 is a SQL injection vulnerability affecting Fortinet FortiAnalyzer and FortiManager appliances. The flaw stems from improper neutralization of special elements used in SQL commands [CWE-89]. An authenticated attacker can send specially crafted HTTP requests to escalate privileges on affected devices. The vulnerability impacts FortiAnalyzer 7.4.0 through 7.4.2 and FortiManager 7.4.0 through 7.4.2, including their cloud editions. Fortinet published details in security advisory FG-IR-24-091.

Critical Impact
Authenticated attackers can leverage crafted HTTP requests to inject SQL statements and escalate privileges on FortiAnalyzer and FortiManager devices, gaining broader administrative control over centralized log and policy management infrastructure.

Affected Products

Fortinet FortiAnalyzer 7.4.0 through 7.4.2 (including FortiAnalyzer Cloud)
Fortinet FortiManager 7.4.0 through 7.4.2 (including FortiManager Cloud)
Deployments exposing the management interface to networked clients

Discovery Timeline

2025-01-14 - CVE-2024-35275 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35275

Vulnerability Analysis

The vulnerability resides in HTTP request handling paths within FortiAnalyzer and FortiManager. User-controlled input reaches SQL query construction without sufficient sanitization or parameterization. An authenticated attacker crafts HTTP requests containing SQL metacharacters that alter query semantics. Successful exploitation results in privilege escalation, providing broader access than the attacker's original account authorizes.

Because FortiAnalyzer and FortiManager act as centralized management and log aggregation platforms across Fortinet fleets, elevated access on these appliances can expose sensitive telemetry, device configurations, and administrative workflows. The CWE-89 classification confirms the root cause is SQL injection rather than a downstream logic flaw.

Root Cause

The underlying defect is improper neutralization of special elements passed into SQL statements. Input arriving through specific HTTP endpoints is concatenated into queries rather than bound as parameters. Attackers can therefore terminate the intended SQL context and append arbitrary clauses that modify authorization data or query results driving privilege checks.

Attack Vector

Exploitation is network-based and requires low-privileged authenticated access to the management interface. The attacker submits HTTP requests containing SQL injection payloads to a vulnerable endpoint. No user interaction is required. Refer to the Fortinet Security Advisory FG-IR-24-091 for endpoint-specific technical details.

No public proof-of-concept exploit is currently listed, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog at the time of writing.

Detection Methods for CVE-2024-35275

Indicators of Compromise

Unexpected privilege changes for administrator or restricted-role accounts on FortiAnalyzer or FortiManager
HTTP requests to management endpoints containing SQL metacharacters such as ', --, UNION, or SELECT
Unusual database error responses returned to authenticated sessions
New or modified administrative accounts without a corresponding change ticket

Detection Strategies

Inspect FortiAnalyzer and FortiManager HTTP access logs for anomalous query parameters or payload lengths on authenticated endpoints
Correlate authentication events with subsequent privileged actions performed by the same session
Alert on repeated HTTP 500 responses from management APIs, which can indicate injection probing

Monitoring Recommendations

Forward FortiAnalyzer and FortiManager audit logs to a centralized SIEM for retention and correlation
Baseline normal administrative API usage and alert on deviations in request volume or structure
Monitor role and permission changes on these appliances with high-priority alerts

How to Mitigate CVE-2024-35275

Immediate Actions Required

Upgrade FortiAnalyzer and FortiManager to a fixed release as directed in Fortinet Security Advisory FG-IR-24-091
Restrict management interface access to trusted administrative networks only
Audit existing administrator and restricted-role accounts for unauthorized privilege changes
Rotate credentials for accounts that could have been used to reach the vulnerable endpoints

Patch Information

Fortinet has released fixed versions addressing CVE-2024-35275 in FortiAnalyzer and FortiManager. Consult Fortinet Security Advisory FG-IR-24-091 for the specific upgrade paths that apply to versions 7.4.0 through 7.4.2 and their cloud variants.

Workarounds

Limit HTTPS management access using trusted host configurations on affected appliances
Place FortiAnalyzer and FortiManager behind a jump host or VPN with multi-factor authentication
Disable or restrict low-privileged administrative accounts that are not strictly required

bash

# Restrict management access to trusted hosts on FortiManager/FortiAnalyzer
config system admin user
    edit "admin"
        set trusthost1 10.0.0.0 255.255.255.0
        set trusthost2 192.168.10.0 255.255.255.0
    next
end