CVE-2024-36507 Overview
CVE-2024-36507 is an untrusted search path vulnerability [CWE-426] in Fortinet FortiClientWindows. The flaw allows a local attacker to execute arbitrary code through DLL hijacking combined with social engineering. Successful exploitation results in full compromise of confidentiality, integrity, and availability on the affected host.
The issue affects FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.4, and versions 7.0.0 through 7.0.12. Fortinet published advisory FG-IR-24-205 addressing the flaw. The vulnerability requires user interaction, but any resulting code runs in the security context of the FortiClient process on Windows endpoints.
Critical Impact
A local attacker can achieve arbitrary code execution on Windows endpoints running vulnerable FortiClient versions by planting a malicious DLL in a search path location.
Affected Products
- Fortinet FortiClientWindows 7.4.0
- Fortinet FortiClientWindows 7.2.0 through 7.2.4
- Fortinet FortiClientWindows 7.0.0 through 7.0.12
Discovery Timeline
- 2024-11-12 - CVE-2024-36507 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-36507
Vulnerability Analysis
CVE-2024-36507 is a DLL hijacking vulnerability caused by an untrusted search path [CWE-426] in FortiClientWindows. The application resolves one or more dependent libraries using a search order that includes directories writable or influenceable by a non-privileged user. When a malicious library with the expected name is present in a location searched before the legitimate DLL, FortiClient loads and executes the attacker-controlled code.
Exploitation requires user interaction. An attacker must convince the target user to open a file, launch a payload, or otherwise trigger the vulnerable load sequence from a directory containing the malicious DLL. Because the attack vector is local, remote exploitation without user cooperation is not feasible.
Root Cause
The underlying weakness stems from insecure resolution of DLL dependencies in FortiClientWindows. Windows applications that call LoadLibrary without a fully qualified path, or that load libraries from a working directory before verifying signatures, are subject to search-order hijacking. In this case, FortiClient's search behavior permits a rogue DLL located in a user-controlled directory to be loaded in preference to the intended system library.
Attack Vector
The attack chain typically begins with social engineering. An adversary delivers an archive, network share link, or removable-media payload containing both a lure file and a malicious DLL. When the user launches the lure from that directory, FortiClient loads the attacker's DLL and executes its DllMain routine. See the Fortinet PSIRT Advisory FG-IR-24-205 for vendor guidance on affected versions and fixes.
Detection Methods for CVE-2024-36507
Indicators of Compromise
- Unexpected DLL files located in the same directory as FortiClient executables or user-writable working directories.
- FortiClient processes loading modules from non-standard paths such as %USERPROFILE%\Downloads or removable drives.
- New or modified DLLs with names matching common Windows system libraries appearing outside System32.
Detection Strategies
- Hunt for Image Load events (Sysmon Event ID 7) where the parent process is a FortiClient binary and the loaded module resides outside trusted directories.
- Alert on unsigned or invalidly signed DLLs being loaded by FortiClient processes.
- Correlate user file-open activity with subsequent DLL creation events in the same directory to identify staging behavior.
Monitoring Recommendations
- Enable Sysmon with a module-load configuration and forward logs to a centralized analytics platform.
- Monitor writes to directories that FortiClient reads during startup or runtime for .dll extensions.
- Baseline the set of DLLs normally loaded by FortiClient processes and alert on deviations.
How to Mitigate CVE-2024-36507
Immediate Actions Required
- Upgrade FortiClientWindows to a fixed release as identified in Fortinet advisory FG-IR-24-205.
- Inventory endpoints running FortiClient 7.4.0, 7.2.0-7.2.4, and 7.0.0-7.0.12 and prioritize their remediation.
- Educate users to avoid executing files from untrusted archives, network shares, or removable media.
Patch Information
Fortinet has published fixed versions of FortiClientWindows in advisory FG-IR-24-205. Refer to that advisory for the specific patched builds corresponding to each affected release train, and apply them through your standard endpoint software distribution process.
Workarounds
- Restrict user ability to execute files from Downloads, temporary folders, and removable media using application control policies.
- Enforce Windows Defender Application Control (WDAC) or AppLocker rules that block loading of unsigned DLLs by FortiClient.
- Configure the CWDIllegalInDllSearch registry key to remove the current working directory from the DLL search order where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
