CVE-2024-55590 Overview
CVE-2024-55590 is an OS Command Injection vulnerability [CWE-78] affecting Fortinet FortiIsolator versions 2.4.0 through 2.4.5. The flaw allows an authenticated attacker with at least read-only administrative permission and CLI access to execute unauthorized code through specifically crafted CLI commands. Fortinet published the advisory FG-IR-24-178 documenting multiple injection points within the affected CLI interface. The vulnerability carries a CVSS 3.1 base score of 8.8 and impacts confidentiality, integrity, and availability of the appliance.
Critical Impact
Authenticated attackers with read-only admin access can escape the restricted CLI and execute arbitrary operating system commands on the FortiIsolator appliance.
Affected Products
- Fortinet FortiIsolator 2.4.0
- Fortinet FortiIsolator versions 2.4.1 through 2.4.4
- Fortinet FortiIsolator 2.4.5
Discovery Timeline
- 2025-03-11 - CVE-2024-55590 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-55590
Vulnerability Analysis
CVE-2024-55590 involves multiple OS Command Injection weaknesses in the FortiIsolator command line interface. FortiIsolator is a remote browser isolation appliance designed to render untrusted web content in an isolated environment. The CLI accepts user-supplied parameters that are passed to underlying operating system commands without adequate neutralization of shell metacharacters. An authenticated administrator, even one restricted to read-only permissions, can inject additional commands that execute in the context of the underlying appliance operating system. Because the attack occurs through the administrative CLI, exploitation requires valid credentials but does not require write privileges within the management application.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-78]. Multiple CLI handlers construct shell command strings by concatenating user input rather than passing arguments through a safe API. Shell metacharacters such as backticks, semicolons, and command substitution constructs are not filtered before the command string is passed to the system shell.
Attack Vector
An attacker requires network reachability to the FortiIsolator management CLI and valid administrative credentials with at least read-only permission. After authenticating over SSH or console, the attacker issues a CLI command containing shell metacharacters within a parameter that is later interpolated into a system command. The injected payload executes with the privileges of the CLI backend process, bypassing the intended restricted shell boundary and providing arbitrary code execution on the appliance.
No verified public proof-of-concept code is available for this vulnerability. Refer to the Fortinet Security Advisory FG-IR-24-178 for authoritative technical details.
Detection Methods for CVE-2024-55590
Indicators of Compromise
- Unexpected child processes spawned by FortiIsolator CLI handler processes, particularly shells such as /bin/sh or /bin/bash invoked outside normal administrative workflows.
- CLI audit log entries containing shell metacharacters (;, |, `, $(), &&) within command parameters.
- Administrative sessions from read-only accounts issuing commands that historically require elevated privileges.
- Outbound network connections initiated by the appliance to hosts that do not match its documented isolation traffic patterns.
Detection Strategies
- Enable and centralize FortiIsolator CLI audit logging, then alert on parameter values containing shell metacharacters.
- Baseline normal administrative command sequences and flag deviations, especially from accounts with read-only roles.
- Correlate administrative login events with subsequent process execution telemetry from the appliance host where available.
Monitoring Recommendations
- Forward FortiIsolator syslog and audit events to a centralized SIEM for long-term retention and correlation.
- Monitor authentication events on the FortiIsolator management interface for brute-force activity and credential reuse.
- Track configuration changes and firmware version state to confirm patched builds remain in place.
How to Mitigate CVE-2024-55590
Immediate Actions Required
- Upgrade FortiIsolator to a fixed release as specified in the Fortinet Security Advisory FG-IR-24-178.
- Restrict management CLI access to a dedicated administrative network segment and trusted jump hosts only.
- Audit all administrator accounts and remove or downgrade any read-only accounts that are no longer required.
- Rotate credentials for any account that had CLI access on vulnerable builds.
Patch Information
Fortinet has released fixed FortiIsolator builds addressing the OS command injection issues. Consult Fortinet PSIRT advisory FG-IR-24-178 for the specific upgrade paths from 2.4.0 through 2.4.5 to the remediated version.
Workarounds
- Limit CLI access to a small set of named administrators and require multi-factor authentication for the management plane.
- Place FortiIsolator management interfaces behind an ACL that permits SSH and console access only from authorized administrative subnets.
- Enable command auditing and forward logs off-box so that any post-exploitation activity can be reconstructed.
# Example: restrict SSH management access to an administrative subnet
# (apply on the upstream firewall protecting the FortiIsolator management interface)
access-list MGMT_IN permit tcp 10.10.50.0/24 host <fortiisolator-mgmt-ip> eq 22
access-list MGMT_IN deny tcp any host <fortiisolator-mgmt-ip> eq 22
access-list MGMT_IN permit ip any any
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
