Saint FortiJump-Higher, Who Jumped Even Higher

Patron of the FortiManagers that govern the firewalls, incomplete patches, and everyone who thought they had closed it all.

Life

On 14 November 2024 watchTowr researchers showed FortiJump-Higher: the fix for the famous FortiJump (CVE-2024-47575), the flaw that let a managed device seize the central FortiManager, was incomplete. A command injection remained in the "som/export" handler, working even on patched boxes, letting a compromised FortiGate escalate privileges up to the FortiManager. One jump, then another even higher.

Prayer

O Saint FortiJump-Higher, who leaps past the patch we thought was closed, let our fixes touch the right code. Amen.

How to celebrate

Celebrated by requiring device registration, limiting who can reach the FortiManager and checking that the patch really closes the hole.

A patch that misses the bug invites a higher jump.