CVE-2024-54021: Fortinet FortiProxy Auth Bypass Vulnerability

CVE-2024-54021 Overview

CVE-2024-54021 is an HTTP response splitting vulnerability [CWE-113] affecting Fortinet FortiOS and FortiProxy. The flaw stems from improper neutralization of Carriage Return and Line Feed (CRLF) sequences in HTTP headers. A remote unauthenticated attacker can send crafted HTTP headers to bypass the file filter enforced by the affected products. The issue impacts FortiOS versions 7.2.0 through 7.6.0 and FortiProxy versions 7.2.0 through 7.4.5. Successful exploitation allows content that should be blocked to pass through the security gateway.

Critical Impact
A remote unauthenticated attacker can bypass file filter policies on FortiOS and FortiProxy by injecting CRLF sequences into HTTP headers.

Affected Products

Fortinet FortiOS 7.2.0 through 7.6.0
Fortinet FortiProxy 7.2.0 through 7.4.5
Deployments relying on FortiOS/FortiProxy file filter policies for HTTP traffic inspection

Discovery Timeline

2025-01-14 - CVE-2024-54021 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54021

Vulnerability Analysis

The vulnerability resides in how FortiOS and FortiProxy parse HTTP headers when applying file filter policies. Attackers can inject raw CRLF (\r\n) sequences into header values that the product forwards or interprets. This injection splits a single HTTP response or request stream into structures the file filter did not expect. As a result, file content that would normally be inspected and blocked reaches the client or server unfiltered. The flaw does not require authentication and is exploitable over the network.

Root Cause

The root cause is missing neutralization of CRLF characters in HTTP header handling logic, classified under [CWE-113]. The affected components accept attacker-controlled header input without stripping or encoding line terminators. When downstream parsers process the reassembled headers, the injected sequences alter message boundaries and content-type interpretation. This breaks the assumptions used by the file filter engine to identify blocked file categories.

Attack Vector

Exploitation occurs over the network with no privileges and no user interaction. An attacker constructs an HTTP request whose headers contain embedded CRLF sequences and additional forged header fields. The crafted traffic traverses a FortiOS or FortiProxy device configured with file filter policies. The filter fails to correctly identify the payload, allowing prohibited files to be delivered through the gateway. See the Fortinet Security Advisory FG-IR-24-282 for vendor technical details.

Detection Methods for CVE-2024-54021

Indicators of Compromise

HTTP requests or responses containing embedded \r\n or %0d%0a sequences within header values passing through FortiOS or FortiProxy.
File downloads that should have been blocked by configured file filter profiles but reached internal clients.
Unexpected duplicate or malformed HTTP headers logged in web proxy telemetry.

Detection Strategies

Inspect proxy and web gateway logs for header values containing CRLF byte sequences or unusual whitespace.
Correlate file filter policy hits with downstream endpoint file-write events to identify filter bypass patterns.
Compare file types delivered to endpoints against the file filter policy expected to block them.

Monitoring Recommendations

Enable verbose logging on FortiOS and FortiProxy file filter and web filter modules.
Forward Fortinet HTTP inspection logs to a centralized analytics platform for anomaly correlation.
Monitor for repeated malformed HTTP header patterns originating from external IP addresses.

How to Mitigate CVE-2024-54021

Immediate Actions Required

Review the Fortinet Security Advisory FG-IR-24-282 and identify affected FortiOS and FortiProxy instances.
Upgrade FortiOS and FortiProxy to the fixed versions specified in the vendor advisory.
Audit file filter policies and validate that inspection is functioning after patching.

Patch Information

Fortinet has published fixed builds in advisory FG-IR-24-282. Administrators should upgrade FortiOS beyond the 7.2.0–7.6.0 vulnerable range and FortiProxy beyond the 7.2.0–7.4.5 vulnerable range to versions identified as fixed in the advisory. Apply upgrades following Fortinet's standard maintenance guidance.

Workarounds

Restrict inbound HTTP traffic through the affected devices where feasible until patches are applied.
Layer additional inspection controls, such as a downstream secure web gateway, to reduce reliance on the single file filter.
Deploy IPS signatures published by Fortinet that detect HTTP response splitting patterns.

bash

# Verify current FortiOS version before and after upgrade
get system status | grep Version

# Review file filter profile configuration
show full-configuration file-filter profile