FG-IR-24-372: Domain fronting protection bypass in explicit web proxy
Published Oct 14, 2025
·Updated
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS and FortiProxy explicit web proxy may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.
Affected Software
5 affected componentsFixes available
Fortinet FortiOS>=7.6.0<=7.6.3
Fortinet FortiProxy>=7.6.0<=7.6.3
Fortinet FortiProxy>=7.4.0<=7.4.11
Fortinet FortiProxy>=7.2
Fortinet FortiProxy>=7.0.1<=7.0.22
Event History
Oct 14, 2025
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of FG-IR-24-372?
The severity of FG-IR-24-372 is high due to the potential for authenticated users to bypass critical security features.
2
How do I fix FG-IR-24-372?
To fix FG-IR-24-372, upgrade FortiOS or FortiProxy to version 7.6.4 or later.
3
Which versions are affected by FG-IR-24-372?
FG-IR-24-372 affects FortiOS and FortiProxy versions from 7.6.0 to 7.6.3, as well as some specific earlier versions of FortiProxy.
4
Who is the vendor for FG-IR-24-372?
The vendor for FG-IR-24-372 is Fortinet.
5
What type of vulnerability is FG-IR-24-372?
FG-IR-24-372 is classified as an improperly implemented security check for standard vulnerability (CWE-358).