Collected research

Two Bytes is Plenty: FortiGate RCE with CVE-2024-21762

Dylan Pindur

Analyzes a FortiGate HTTP chunk-trailer parsing flaw where a two-byte overwrite corrupts adjacent heap metadata. Careful heap grooming and a function-pointer chain turn the small memory-corruption primitive into unauthenticated remote code execution.

Record

Researcher

Dylan Pindur

In the archive

• Collected in the 2024 research round

Tags

• http
• memory-corruption
• rce
• embedded-device
• attack-chain

This page is the archive's own catalogue record. The research is the work of Dylan Pindur, first published at the original source. Preserved copies are kept so the citation survives its host.