CVE-2024-50570: Fortinet FortiClient Info Disclosure Flaw

CVE-2024-50570 Overview

A Cleartext Storage of Sensitive Information vulnerability (CWE-312) has been identified in FortiClientWindows and FortiClientLinux. This security flaw may permit a local authenticated user to retrieve VPN passwords via memory dump, due to JavaScript's garbage collector failing to properly clear sensitive data from memory.

Critical Impact

Local authenticated attackers can extract VPN credentials from memory, potentially leading to unauthorized VPN access and lateral movement within corporate networks.

Affected Products

• FortiClientWindows 7.4.0 through 7.4.1
• FortiClientWindows 7.2.0 through 7.2.6
• FortiClientWindows 7.0.0 through 7.0.13
• FortiClientLinux 7.4.0 through 7.4.2
• FortiClientLinux 7.2.0 through 7.2.7
• FortiClientLinux 7.0.0 through 7.0.13

Discovery Timeline

• 2024-12-18 - CVE-2024-50570 published to NVD
• 2025-07-24 - Last updated in NVD database

Technical Details for CVE-2024-50570

Vulnerability Analysis

This vulnerability stems from improper handling of sensitive information in memory by the FortiClient VPN application. The root cause is related to JavaScript's garbage collection mechanism, which does not guarantee immediate or secure removal of sensitive data from memory. When users authenticate to a VPN connection, their credentials may remain in cleartext within the application's memory space longer than necessary.

The local attack vector requires the attacker to have authenticated access to the system where FortiClient is installed. While the attack complexity is high and requires user interaction, successful exploitation allows reading of highly confidential VPN credentials. The changed scope indicator suggests that exploitation could impact resources beyond the vulnerable component itself.

Root Cause

The vulnerability exists because JavaScript's garbage collector operates non-deterministically, meaning that memory containing sensitive information like VPN passwords is not securely wiped when no longer needed. Instead, the data persists in memory until the garbage collector reclaims the memory space, which may be significantly delayed. This behavior violates secure coding practices that mandate immediate sanitization of sensitive data after use.

Attack Vector

An attacker with local authenticated access to the target system can exploit this vulnerability by performing a memory dump of the FortiClient process. The attack scenario involves:

1. Gaining local authenticated access to a system running a vulnerable FortiClient version
2. Waiting for a legitimate user to authenticate to a VPN connection
3. Dumping the FortiClient process memory using standard system tools or memory forensics utilities
4. Searching the memory dump for cleartext VPN credentials
5. Using the extracted credentials for unauthorized VPN access

The vulnerability requires high privileges and user interaction, as the attacker needs the victim to actively enter their VPN credentials while the attacker has access to the system. This attack could be particularly effective in insider threat scenarios or post-compromise situations where an attacker has established persistent access.

Detection Methods for CVE-2024-50570

Indicators of Compromise

• Unexpected memory dump files targeting FortiClient processes (FortiClient.exe on Windows, FortiClient binaries on Linux)
• Suspicious process access patterns from memory forensics tools accessing FortiClient memory space
• Anomalous VPN authentication attempts using credentials from systems where memory access was detected

Detection Strategies

• Monitor for process memory access attempts targeting FortiClient executables using endpoint detection tools
• Deploy memory protection mechanisms that alert on unauthorized process memory reads
• Implement behavioral analytics to detect memory dumping tools such as procdump, minidump, or similar utilities
• Enable enhanced logging for FortiClient process interactions

Monitoring Recommendations

• Configure SentinelOne Singularity Platform to detect memory access anomalies and process injection attempts
• Implement alerting for the use of memory forensics tools on endpoints with FortiClient installed
• Monitor Windows Event Logs for suspicious process access events (Event ID 4663, 4656)
• On Linux systems, monitor for ptrace syscalls targeting FortiClient processes

How to Mitigate CVE-2024-50570

Immediate Actions Required

• Upgrade FortiClientWindows to version 7.4.2 or later, 7.2.7 or later, or 7.0.14 or later
• Upgrade FortiClientLinux to version 7.4.3 or later, 7.2.8 or later, or 7.0.14 or later
• Review all VPN access logs for suspicious authentication patterns
• Consider rotating VPN credentials for users on potentially affected systems

Patch Information

Fortinet has released security updates addressing this vulnerability. Detailed patch information is available in the Fortinet PSIRT Advisory FG-IR-23-278. Organizations should prioritize upgrading to patched versions of FortiClient for both Windows and Linux platforms.

Workarounds

• Restrict local administrative access to systems running FortiClient to reduce the attack surface
• Implement application whitelisting to prevent unauthorized memory dumping tools from executing
• Enable additional endpoint protection mechanisms that can detect and block memory access attempts
• Consider using hardware-based credential storage where available

# Verify FortiClient version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Fortinet\FortiClient" | Select-Object -Property Version

# Verify FortiClient version on Linux
forticlient --version

# Check for memory dumping tools on Windows
Get-Process | Where-Object {$_.ProcessName -match "procdump|minidump|dumpit"}