CVE-2024-45327: Fortinet FortiSOAR Auth Bypass Flaw

CVE-2024-45327 Overview

CVE-2024-45327 is an improper authorization vulnerability [CWE-285] affecting the change password endpoint in Fortinet FortiSOAR. The flaw permits an authenticated attacker to conduct brute force attacks against user and administrator passwords through crafted HTTP requests. The endpoint fails to implement adequate rate limiting or authorization controls, enabling password guessing at scale. Affected releases span FortiSOAR 7.0.0 through 7.4.3 across multiple product branches. Fortinet published the advisory FG-IR-24-048 alongside the NVD entry.

Critical Impact
An authenticated attacker with low privileges can brute force credentials of higher-privileged users and administrators, leading to full account takeover and compromise of the security orchestration platform.

Affected Products

Fortinet FortiSOAR 7.4.0 through 7.4.3
Fortinet FortiSOAR 7.3.0 through 7.3.2, and 7.2.0 through 7.2.2
Fortinet FortiSOAR 7.0.0 through 7.0.3

Discovery Timeline

2024-09-11 - CVE-2024-45327 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45327

Vulnerability Analysis

FortiSOAR is Fortinet's Security Orchestration, Automation, and Response (SOAR) platform used to centralize incident response workflows. The vulnerability resides in the change password endpoint, which processes password modification requests over HTTP. The endpoint accepts repeated authentication attempts against the current password field without enforcing lockout thresholds or brute force protection. An attacker with valid low-privileged credentials can iterate through candidate passwords for any target account, including administrators. Successful exploitation compromises the confidentiality, integrity, and availability of the SOAR platform, which typically holds privileged connectors into downstream security tooling.

Root Cause

The root cause is missing authorization and missing brute force protection on the change password workflow, tracked as [CWE-307] (Improper Restriction of Excessive Authentication Attempts). The endpoint validates the supplied current password on each request but does not throttle failed attempts, rate limit by source, or enforce account lockout. This design allows unlimited password guessing at network speed against any account known to the attacker.

Attack Vector

Exploitation requires network access to the FortiSOAR web interface and valid authenticated credentials for at least one account. The attacker sends a series of crafted HTTP requests to the change password endpoint, varying the current password value and observing the server response to distinguish valid from invalid guesses. Because the attack traffic originates from an authenticated session, it can bypass perimeter controls that inspect only unauthenticated access. High attack complexity reflects the requirement for prior credential access and enumeration of target usernames.

No public proof-of-concept code is available for CVE-2024-45327. Refer to the Fortinet Security Advisory FG-IR-24-048 for authoritative technical details.

Detection Methods for CVE-2024-45327

Indicators of Compromise

High volume of HTTP POST requests to the FortiSOAR change password endpoint from a single authenticated session or source address.
Repeated 4xx responses from the change password endpoint followed by a successful 2xx response for a targeted user account.
Unexpected password changes on administrator or privileged service accounts within FortiSOAR audit logs.

Detection Strategies

Enable verbose HTTP access logging on the FortiSOAR appliance and alert on request rate anomalies against the change password path.
Correlate authentication events with password change events in the FortiSOAR audit trail to identify accounts targeted by iterative attempts.
Baseline normal password change frequency per user and flag deviations that exceed the baseline by an order of magnitude.

Monitoring Recommendations

Forward FortiSOAR application and audit logs to a centralized SIEM for long-term retention and cross-correlation with identity provider events.
Monitor privileged account activity in FortiSOAR for session anomalies, geographic irregularities, and off-hours password changes.
Track failed authentication metrics per account and per source IP, and alert on sustained failure bursts.

How to Mitigate CVE-2024-45327

Immediate Actions Required

Upgrade FortiSOAR to a fixed release as specified in Fortinet Security Advisory FG-IR-24-048.
Rotate credentials for all FortiSOAR user and administrator accounts, prioritizing privileged and service accounts.
Restrict network access to the FortiSOAR management interface to trusted administrative networks only.

Patch Information

Fortinet has released fixed versions addressing CVE-2024-45327. Consult the Fortinet Security Advisory FG-IR-24-048 for the specific patched release corresponding to each affected branch (7.0.x, 7.2.x, 7.3.x, and 7.4.x). Apply the upgrade during the next maintenance window and validate that the change password endpoint enforces lockout after the update.

Workarounds

Enforce strong, unique passwords and multi-factor authentication for all FortiSOAR accounts to raise the cost of a successful brute force attempt.
Place the FortiSOAR web interface behind a reverse proxy or web application firewall that enforces per-account rate limiting on password change requests.
Audit and disable inactive or unnecessary FortiSOAR accounts to reduce the pool of credentials an attacker can leverage as an authenticated foothold.

bash

# Example WAF rule concept: throttle change password endpoint
# Adjust path and thresholds to match your FortiSOAR deployment
limit_req_zone $binary_remote_addr zone=fsr_pw:10m rate=5r/m;

location /api/auth/change-password {
    limit_req zone=fsr_pw burst=5 nodelay;
    proxy_pass https://fortisoar.internal;
}