CVE-2024-33502
Published: 14 January 2025
Summary
CVE-2024-33502 is a medium-severity Path Traversal (CWE-22) vulnerability in Fortinet Fortianalyzer. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 28.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-33502 is a path traversal vulnerability (CWE-22) affecting Fortinet FortiManager and FortiAnalyzer in versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.12, and 6.0.0 through 6.0.12. It stems from improper limitation of a pathname to a restricted directory, enabling attackers to execute unauthorized code or commands through crafted HTTP or HTTPS requests. The vulnerability carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H), indicating medium severity with high integrity and availability impacts but no confidentiality loss.
Exploitation requires high privileges (PR:H), allowing a privileged remote attacker with network access to craft malicious requests that traverse directory restrictions and achieve remote code execution. The low attack complexity and lack of user interaction make it feasible for authenticated administrative users to abuse, potentially leading to full system compromise, command injection, or persistence within the affected FortiManager or FortiAnalyzer instances.
Fortinet's advisory at https://fortiguard.fortinet.com/psirt/FG-IR-24-143 provides details on patches and mitigation recommendations for this issue, published on 2025-01-14. Security practitioners should consult the advisory for version-specific upgrades and any interim workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-31240
Vulnerability details
An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.12 and 6.4.0 through 6.4.14 and 6.2.0 through 6.2.12 and 6.0.0 through 6.0.12…
more
allows attacker to execute unauthorized code or commands via crafted HTTP or HTTPs requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing FortiManager/FortiAnalyzer directly enables remote exploitation for code/command execution (RCE) over HTTP/HTTPS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates path traversal by requiring validation of crafted HTTP/HTTPS pathname inputs to prevent access to restricted directories.
Enforces approved access authorizations to information and system resources, preventing unauthorized directory traversal and code execution.
Requires identification, reporting, and correction of flaws like this path traversal vulnerability through timely patching as advised by Fortinet.