CVE-2024-55594
Published: 14 March 2025
Summary
CVE-2024-55594 is a medium-severity Improper Handling of Syntactically Invalid Structure (CWE-228) vulnerability in Fortinet Fortiweb. Its CVSS base score is 5.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely application of vendor patches for the affected FortiWeb versions to remediate the improper handling of invalid structures.
Requires validation of HTTP/S inputs to reject syntactically invalid structures before processing, preventing crafted requests from triggering code execution.
Ensures secure error handling for malformed HTTP requests, avoiding exploitation through improper processing that leads to unauthorized code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes remote unauthenticated code/command execution via crafted HTTP/S requests against a public-facing FortiWeb instance, directly enabling T1190 (Exploit Public-Facing Application).
NVD Description
An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.
Deeper analysisAI
CVE-2024-55594 involves an improper handling of syntactically invalid structure (CWE-228) in Fortinet FortiWeb, affecting versions 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10. The vulnerability stems from inadequate processing of malformed structures in HTTP/S requests, enabling attackers to execute unauthorized code or commands.
A remote, unauthenticated attacker (PR:N) can exploit this over the network (AV:N) by sending crafted HTTP/S requests, though it requires high attack complexity (AC:H) and no user interaction (UI:N). Exploitation results in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) within the unchanged security scope (S:U), yielding a CVSS v3.1 base score of 5.6.
Fortinet's advisory FG-IR-23-115, available at https://fortiguard.fortinet.com/psirt/FG-IR-23-115, provides details on the vulnerability. Security practitioners should review it for recommended mitigations and patching guidance.
Details
- CWE(s)