CVE-2024-55597: Fortinet FortiWeb Path Traversal Flaw

CVE-2024-55597 Overview

CVE-2024-55597 is a path traversal vulnerability [CWE-22] affecting Fortinet FortiWeb versions 7.0.0 through 7.6.0. The flaw allows an authenticated attacker with high privileges to execute unauthorized code or commands through crafted requests. FortiWeb is Fortinet's web application firewall product, deployed to protect web applications and APIs from attacks.

The vulnerability stems from improper limitation of a pathname to a restricted directory. Attackers can manipulate file path inputs to escape intended directory boundaries and reach sensitive resources. Fortinet published this issue in advisory FG-IR-24-439.

Critical Impact
Successful exploitation enables unauthorized code or command execution on the FortiWeb appliance, compromising the confidentiality, integrity, and availability of the web application firewall.

Affected Products

Fortinet FortiWeb 7.0.0 through 7.0.x
Fortinet FortiWeb 7.2.0 through 7.2.x
Fortinet FortiWeb 7.4.0 through 7.6.0

Discovery Timeline

2025-03-11 - CVE-2024-55597 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55597

Vulnerability Analysis

CVE-2024-55597 is a path traversal vulnerability in Fortinet FortiWeb. FortiWeb fails to properly sanitize file path parameters supplied in requests. An attacker with high-privilege access can supply crafted input containing directory traversal sequences such as ../ to reference locations outside the intended directory.

The root weakness maps to [CWE-22]: Improper Limitation of a Pathname to a Restricted Directory. Because FortiWeb processes the manipulated path without adequate validation, the attacker gains access to files or interfaces that were not meant to be exposed. This escalates from a file-access issue into unauthorized code or command execution on the appliance.

Exploitation requires network access to a management or API endpoint and high privileges on the target device. No user interaction is required. Successful exploitation results in high impact to confidentiality, integrity, and availability.

Root Cause

The root cause is insufficient input validation on path parameters within FortiWeb request handlers. Path components are used to construct file system references without normalization or containment checks against an allow-listed base directory. This permits traversal sequences to resolve to arbitrary locations on the appliance file system.

Attack Vector

An authenticated attacker with administrative-level privileges sends a crafted HTTP request containing malicious path traversal sequences to a vulnerable FortiWeb endpoint. The request causes FortiWeb to read, write, or execute resources outside the expected directory. Because FortiWeb is typically deployed as a security control in front of critical web applications, compromise of the appliance provides a strategic pivot point for further attacks.

No public proof-of-concept exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Refer to the FortiGuard PSIRT Advisory FG-IR-24-439 for vendor-published technical details.

Detection Methods for CVE-2024-55597

Indicators of Compromise

HTTP requests containing directory traversal sequences such as ../, ..%2f, or encoded variants targeting FortiWeb management interfaces or APIs
Unexpected file access, creation, or modification events on the FortiWeb appliance file system
Administrative session activity originating from unusual source addresses or at atypical times
Unexplained command execution or process spawning on the FortiWeb device

Detection Strategies

Inspect FortiWeb access and audit logs for path parameters containing traversal patterns or unusual character encodings
Correlate high-privilege administrative logins with subsequent anomalous API activity or configuration changes
Deploy network-level detection rules on management traffic to flag traversal sequences in URLs and request bodies

Monitoring Recommendations

Forward FortiWeb management, audit, and system logs to a centralized SIEM for retention and correlation
Alert on privileged administrator account creation, credential resets, and configuration exports outside change windows
Monitor egress traffic from FortiWeb appliances for connections to unexpected external destinations

How to Mitigate CVE-2024-55597

Immediate Actions Required

Apply the fixed FortiWeb release identified in Fortinet advisory FG-IR-24-439 as soon as feasible
Restrict access to FortiWeb management and API interfaces to trusted administrative networks only
Rotate credentials for all administrative accounts on affected FortiWeb devices
Review recent administrative activity and configuration changes for signs of unauthorized use

Patch Information

Fortinet has published remediation guidance in FortiGuard PSIRT Advisory FG-IR-24-439. Administrators should upgrade FortiWeb to a fixed version as specified by the vendor. Versions 7.0.0 through 7.6.0 are affected and require action.

Workarounds

Limit administrative access to FortiWeb using trusted-host restrictions and management ACLs until patches are applied
Enforce multi-factor authentication on all FortiWeb administrative accounts to raise the barrier for privileged access
Isolate FortiWeb management interfaces on a dedicated out-of-band administrative network segment

bash

# Example: restrict FortiWeb administrative access to trusted hosts
config system admin
    edit "admin"
        set trusthost1 10.0.0.0 255.255.255.0
        set trusthost2 192.168.100.0 255.255.255.0
    next
end