CVE-2024-50562 Overview
CVE-2024-50562 is an Insufficient Session Expiration vulnerability [CWE-613] affecting FortiOS SSL-VPN across multiple versions. An attacker in possession of a valid session cookie can reuse that cookie to authenticate to the SSL-VPN portal after the session has expired or the user has explicitly logged out. The flaw allows attackers who obtain a cookie through theft, interception, or endpoint compromise to maintain persistent access beyond the intended session lifetime. Fortinet FortiSASE deployments that rely on FortiOS SSL-VPN are also affected. The issue is tracked in Fortinet advisory FG-IR-24-339 and referenced in Siemens advisory SSA-864900.
Critical Impact
Stolen SSL-VPN session cookies remain valid past logout or expiration, enabling unauthorized re-entry to the VPN portal and downstream corporate network resources.
Affected Products
- FortiOS SSL-VPN version 7.6.0
- FortiOS SSL-VPN version 7.4.6 and below, 7.2.10 and below, all 7.0 versions, all 6.4 versions
- Fortinet FortiSASE 24.4.60
Discovery Timeline
- 2025-06-10 - CVE-2024-50562 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-50562
Vulnerability Analysis
The vulnerability resides in how FortiOS SSL-VPN manages authenticated session state. When a user logs out or when a session reaches its configured expiration, the server-side session record is not fully invalidated. The cookie value tied to that session continues to be accepted by the portal, allowing re-authentication without re-entering credentials.
This type of session mismanagement removes the assumption that logout equals termination. An attacker who captured a cookie earlier through browser exfiltration, an infostealer, a shared workstation, or a proxy interception can present the cookie later and obtain SSL-VPN access. Multi-factor authentication is bypassed because the cookie itself represents a completed authentication event.
The attack requires network reachability to the SSL-VPN portal and prior possession of a valid session cookie. Complexity is elevated because the attacker must first obtain the cookie, but no user interaction is required at exploitation time.
Root Cause
The root cause is incomplete session lifecycle enforcement on the server side. Session identifiers are not tied to a strict server-tracked expiration or revocation list, so tokens continue to authorize access after the client-side session ends.
Attack Vector
Exploitation proceeds in two stages. First, the attacker acquires a valid SSL-VPN session cookie through endpoint malware, cross-site scripting on adjacent services, network interception, or physical access. Second, the attacker submits the cookie to the SSL-VPN portal after the legitimate user has logged out or the session has timed out. The portal accepts the cookie and grants the attacker an authenticated VPN session with the original user's privileges.
No verified public exploit code is available at this time. Technical details are described in the Fortinet advisory referenced below.
Detection Methods for CVE-2024-50562
Indicators of Compromise
- SSL-VPN portal authentication events reusing a session cookie after a prior logout event for the same user
- VPN sessions originating from IP addresses or geolocations that differ from the user's recent authentication history
- Concurrent or rapidly sequential SSL-VPN sessions tied to the same account from disparate sources
- Session establishment without a corresponding credential or MFA challenge event in identity provider logs
Detection Strategies
- Correlate FortiOS SSL-VPN authentication logs with logout events to identify cookie reuse after session termination
- Baseline expected session durations per user and alert on sessions that appear after the previous session was logged out
- Cross-reference VPN portal access with endpoint logs to detect cookie theft precursors such as browser credential store access or infostealer activity
Monitoring Recommendations
- Forward FortiOS SSL-VPN authentication, logout, and session events to a centralized logging platform for retention and correlation
- Monitor for anomalous geographic or ASN transitions across sequential VPN sessions for the same account
- Alert on SSL-VPN logins that occur outside business hours or from devices lacking recent endpoint telemetry
How to Mitigate CVE-2024-50562
Immediate Actions Required
- Upgrade FortiOS to a fixed release as identified in Fortinet advisory FG-IR-24-339
- Force logout of all active SSL-VPN sessions and rotate session secrets after patching
- Require re-authentication with MFA for all SSL-VPN users after the upgrade
- Review SSL-VPN authentication logs for signs of cookie reuse against any account
Patch Information
Fortinet has published remediation guidance in Fortinet Security Advisory FG-IR-24-339. Administrators should consult the advisory for the specific fixed versions across the 7.6, 7.4, and 7.2 branches. FortiOS 7.0 and 6.4 users are advised to migrate to a supported, patched branch. Siemens customers using affected Fortinet components should also review Siemens Advisory SSA-864900.
Workarounds
- Disable SSL-VPN where not operationally required and rely on IPsec VPN alternatives
- Restrict SSL-VPN portal access to specific source IP ranges through firewall policies
- Shorten SSL-VPN session timeout values and enforce periodic re-authentication
- Enforce MFA at the identity provider layer and bind sessions to client certificates where supported
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
