Coverage › CVE-2024-55591

CVE-2024-55591 Mapped Sigma

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Vendor / product

Fortinet — FortiOS and FortiProxy

Description (CISA)

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Added to KEV

2025-01-14

Due date

2025-01-21

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Known

CWE

CWE-288

CISA notes

https://fortiguard.fortinet.com/psirt/FG-IR-24-535
https://nvd.nist.gov/vuln/detail/CVE-2024-55591

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1021 Remote Services secondary impact

• DET0269 Behavioral Detection Strategy for Remote Service Logins and Post-Access Activity
  AN0750 Windows

  Logon via RDP or WMI by a user account followed by uncommon command execution, file manipulation, or lateral network connections.

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: TimeWindow LogonUser RemoteHostList
  AN0751 Linux

  SSH session from new source IP followed by interactive shell or privilege escalation (e.g., sudo, su) and outbound lateral connection.

  linux:syslog sshd: Accepted password/publickey → DC0067 Logon Session Creation

  auditd:SYSCALL execve, USER_CMD → DC0064 Command Execution

  Tunable: SourceIP CommandList
  AN0752 macOS

  Remote login via ARD or SSH followed by screensharingd process activity or modification of TCC-protected files.

  macos:unifiedlog eventMessage CONTAINS 'screensharingd' or 'AuthorizationRefCreate' → DC0067 Logon Session Creation

  macos:osquery process_events → DC0032 Process Creation

  Tunable: RemoteService TargetedPath
  AN0753 IaaS

  Use of cloud-based bastion or VM console session followed by commands that initiate outbound SSH or RDP sessions from the cloud instance to other environments.

  AWS:CloudTrail AWS ConsoleLogin, StartSession → DC0067 Logon Session Creation

  AWS:VPCFlowLogs Outbound connections to port 22, 3389 → DC0082 Network Connection Creation

  Tunable: SourceAssetTag TargetPortList
  AN0754 ESXi

  vSphere API logins (vimService) or SSH to ESXi host followed by unauthorized shell commands or lateral remote logins from the ESXi host.

  esxi:vmkernel vim.fault.*, DCUI login, SSH shell → DC0067 Logon Session Creation

  esxi:shell Command execution trace → DC0064 Command Execution

  Tunable: SessionType CommandPattern

Sigma rules tagged attack.t1021 (11)

T1068 Exploitation for Privilege Escalation exploitation technique

• DET0514 Detection Strategy for Exploitation for Privilege Escalation
  AN1419 Windows

  Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

  WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  Tunable: DriverNamePattern TimeWindow ParentProcessPath
  AN1420 Linux

  Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL ACCESS → DC0035 Process Access

  auditd:SYSCALL dmesg → DC0016 Module Load

  Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold
  AN1421 macOS

  Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

  macos:unifiedlog process:exec and kext load events → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

  Tunable: EntitlementList TimeWindow
  AN1422 Containers

  Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

  auditd:SYSCALL capset or setns → DC0067 Logon Session Creation

  containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

  Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged attack.t1068 (31)

All 31 rules on the technique page →

T1078 Valid Accounts primary impact

• DET0560 Detection of Valid Account Abuse Across Platforms
  AN1543 Windows

  Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.

  WinEventLog:Security EventCode=4624 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: LogonType TimeWindow GeoIPMismatch
  AN1544 Linux

  Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Connections sshd or PAM logins → DC0002 User Account Authentication

  Tunable: UserContext HostDensityThreshold LoginMethod
  AN1545 macOS

  Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.

  macos:unifiedlog loginwindow, sshd → DC0088 Logon Session Metadata

  macos:unifiedlog exec logs → DC0032 Process Creation

  Tunable: LoginOrigin ProcessTreeDepth
  AN1546 Identity Provider

  Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.

  saas:okta Sign-in logs / audit events → DC0002 User Account Authentication

  Tunable: MFAFailureCount RiskScoreThreshold IPGeoVelocity
  AN1547 Containers

  Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.

  kubernetes:audit authentication.k8s.io → DC0002 User Account Authentication

  Tunable: ServiceAccountScope ClusterIPWhitelist

Sigma rules tagged attack.t1078 (56)

All 56 rules on the technique page →

T1555 Credentials from Password Stores primary impact

• DET0430 Detect Credentials Access from Password Stores
  AN1198 Windows

  Monitors suspicious access to password stores such as LSASS, DPAPI, Windows Credential Manager, or browser credential databases. Detects anomalous process-to-process access (e.g., Mimikatz accessing LSASS) and correlation of credential store file reads with execution of non-standard processes.

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: TargetProcesses KeywordPatterns
  AN1199 Linux

  Detects access to known password store files (e.g., /etc/shadow, GNOME Keyring, KWallet, browser credential databases). Monitors anomalous process read attempts and suspicious API calls that attempt to extract stored credentials.

  auditd:SYSCALL open/read → DC0055 File Access

  auditd:EXECVE execve → DC0032 Process Creation

  Tunable: MonitoredFiles SuspiciousCommands
  AN1200 macOS

  Monitors Keychain database access and suspicious invocations of security and osascript utilities. Correlates process execution with attempts to dump or unlock Keychain data.

  macos:unifiedlog access to keychain database → DC0055 File Access

  macos:unifiedlog execution of security or osascript → DC0032 Process Creation

  Tunable: AllowedApplications AlertThreshold
  AN1201 IaaS

  Detects attempts to access or enumerate cloud password/secrets storage services such as AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Monitors API calls for abnormal enumeration or bulk retrieval of secrets.

  AWS:CloudTrail GetSecretValue → DC0083 Cloud Service Enumeration

  AWS:CloudTrail Decrypt → DC0021 OS API Execution

  Tunable: UserContext AccessThreshold

Sigma rules tagged attack.t1555 (8)