3BB: CVE-2024-21762 FortiOS SSL-VPN Path Traversal Exploit Attempt (request)

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•2

This rule detects attempts to exploit a path traversal vulnerability (CVE-2024-21762) in FortiOS SSL-VPN by monitoring for malformed GET requests targeting the /remote/fgt_lang endpoint. The rule also tracks successful exploitation by identifying HTTP 200 responses containing Linux password file patterns (root:x:0:0:), indicating potential remote file disclosure.