CVE-2024-55599 Overview
CVE-2024-55599 is an improperly implemented security check vulnerability [CWE-358] affecting Fortinet FortiOS, FortiProxy, and FortiSASE. The flaw allows a remote unauthenticated user to bypass the DNS filter when traffic originates from Apple devices. Because the DNS filtering enforcement path does not correctly evaluate this traffic, policies intended to block malicious or restricted domains can be circumvented. The vulnerability affects FortiOS 7.6.0, 7.4.7 and below, all 7.0 versions, and all 6.4 versions, along with FortiProxy 7.6.1 and below, 7.4.8 and below, all 7.2 versions, and all 7.0 versions.
Critical Impact
Attackers can bypass DNS filtering policies from Apple devices, defeating a control frequently relied on to block command-and-control, phishing, and malware domains.
Affected Products
- Fortinet FortiOS 6.4 (all versions), 7.0 (all versions), 7.4.7 and below, and 7.6.0
- Fortinet FortiProxy 7.0 (all versions), 7.2 (all versions), 7.4.8 and below, and 7.6.1 and below
- Fortinet FortiSASE 24.4.32
Discovery Timeline
- 2025-07-08 - CVE-2024-55599 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-55599
Vulnerability Analysis
The vulnerability is categorized as an Improperly Implemented Security Check for Standard [CWE-358]. FortiOS and FortiProxy enforce DNS filtering to block resolution of domains associated with malware, phishing, and restricted content. In the affected versions, the enforcement logic fails to consistently apply the filter to DNS traffic originating from Apple devices. This gap allows the client to resolve blocked domains despite an active DNS filter profile. The result is a loss of policy integrity for a core web and threat-protection control.
Root Cause
The root cause is an improperly implemented standards check within the DNS filtering pipeline. Fortinet's implementation does not correctly handle a DNS request pattern used by Apple clients, and the filter does not apply as intended. Because the failure lies in enforcement rather than authentication, no credentials or user interaction are required.
Attack Vector
Exploitation is network-based and unauthenticated. An attacker or user on a network protected by an affected FortiOS, FortiProxy, or FortiSASE deployment can issue DNS queries from an Apple device toward domains that should be blocked by policy. The queries are resolved successfully, enabling subsequent connections to attacker-controlled or otherwise restricted destinations. The impact is limited to integrity of DNS filtering; confidentiality and availability are not directly affected.
No public proof-of-concept has been released. See the Fortinet Security Advisory FG-IR-24-053 for vendor technical details.
Detection Methods for CVE-2024-55599
Indicators of Compromise
- DNS resolution logs showing successful queries to domains explicitly blocked by an active DNS filter profile, particularly from Apple client user agents or device fingerprints.
- Endpoint or firewall telemetry showing outbound connections from macOS or iOS devices to domains categorized as malicious, phishing, or otherwise restricted.
- Discrepancies between DNS filter action logs and downstream web filter or application control logs on the same session.
Detection Strategies
- Correlate FortiGate DNS filter logs with client operating system inventory to identify Apple devices that resolved domains outside expected policy behavior.
- Compare passive DNS records collected upstream of the FortiGate against DNS filter decisions to surface domains that were resolved despite policy classification.
- Alert on any Apple-originated DNS traffic reaching resolvers that bypass the FortiGate DNS proxy.
Monitoring Recommendations
- Enable verbose DNS filter logging on FortiOS and FortiProxy and forward logs to a centralized SIEM for correlation.
- Baseline the volume of blocked DNS categories by client platform and alert on sudden drops from macOS or iOS endpoints.
- Monitor egress DNS to external resolvers (port 53, DoT 853, DoH 443) from Apple devices and enforce that only the FortiGate resolver is used.
How to Mitigate CVE-2024-55599
Immediate Actions Required
- Upgrade FortiOS and FortiProxy to fixed releases as listed in FG-IR-24-053.
- Inventory Apple devices operating behind affected FortiGate and FortiProxy deployments and prioritize their egress paths for review.
- Enforce firewall rules that block direct outbound DNS (UDP/TCP 53), DNS-over-TLS (853), and known DNS-over-HTTPS endpoints so clients cannot bypass the FortiGate resolver.
Patch Information
Fortinet has published fixed versions in advisory FG-IR-24-053. Administrators should upgrade FortiOS out of the 6.4, 7.0, 7.4.x (≤7.4.7), and 7.6.0 branches and FortiProxy out of the 7.0, 7.2, 7.4.x (≤7.4.8), and 7.6.x (≤7.6.1) branches to the vendor-recommended fixed releases. Siemens has issued a parallel advisory for affected product integrations in SSA-864900.
Workarounds
- Where immediate patching is not possible, layer additional DNS filtering upstream or downstream of the FortiGate, such as a protective DNS service enforced on managed Apple endpoints.
- Deploy MDM configuration profiles on macOS and iOS to force a controlled DNS resolver and disable client-side DNS-over-HTTPS to third parties.
- Use web filtering, application control, and SSL inspection on the FortiGate to compensate for missed DNS decisions until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
