<\/div>\n

Researchers released a proof-of-concept (PoC) exploit for remote code execution flaw CVE-2024-23108 in Fortinet SIEM solution.<\/h2>\n\n\n\n

Security researchers at Horizon3’s Attack Team released a proof-of-concept (PoC)<\/a> exploit for a remote code execution issue, tracked as CVE-2024-23108<\/a>, in Fortinet’s SIEM solution. The PoC exploit allows executing commands as root on Internet-facing FortiSIEM appliances.<\/p>\n\n\n\n

In February, cybersecurity vendor Fortinet warned<\/a> of two critical vulnerabilities in FortiSIEM, tracked as CVE-2024-23108 and CVE-2024-23109 (CVSS score 10), which could lead to remote code execution.<\/p>\n\n\n\n

\u201cMultiple improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiSIEM supervisor may allow a remote unauthenticated attacker to execute unauthorized commands via crafted API requests.\u201d reads the advisory<\/a> published by Fortinet.<\/em><\/p>\n\n\n\n

The affected products are:<\/p>\n\n\n\n

\n
• FortiSIEM version 7.1.0 through 7.1.1<\/li>\n\n\n\n
• FortiSIEM version 7.0.0 through 7.0.2<\/li>\n\n\n\n
• FortiSIEM version 6.7.0 through 6.7.8<\/li>\n\n\n\n
• FortiSIEM version 6.6.0 through 6.6.3<\/li>\n\n\n\n
• FortiSIEM version 6.5.0 through 6.5.2<\/li>\n\n\n\n
• FortiSIEM version 6.4.0 through 6.4.2<\/li>\n<\/ul>\n\n\n\n

  The CERT-EU also published an advisory for the above vulnerabilities:<\/p>\n\n\n\n

  \u201cIn February 2024, Fortinet quietly updated a 2023 advisory, joining two critical flows to the list of OS Command vulnerabilities affecting its FortiSIEM product. If exploited, these vulnerabilities could allow a remote unauthenticated attacker to execute commands on the system.\u201d reads the advisory<\/a> published by CERT-EU. \u201cUpdating is recommended as soon as possible.\u201d<\/em><\/gwmw><\/p>\n\n\n\n

  This week, Horizon3’s Attack Team also published a technical analysis<\/a> of the vulnerability.<\/p>\n\n\n\n

  “While the patches for the original PSIRT issue, FG-IR-23-130<\/a>, attempted to escape user-controlled inputs at this layer by adding the wrapShellToken()<\/code> utility, there exists a second order command injection when certain parameters to datastore.py<\/code> are sent. There” reads the analysis<\/a>.<\/em><\/p>\n\n\n\n

  The researchers noticed that the logs for the phMonitor service, located at \/opt\/phoenix\/logs\/phoenix.log, provide detailed records of received messages. Any exploitation attempt of CVE-2024-23108 will generate log entries indicating a failed command with “datastore.py nfs test.” These lines should be used as indicators of compromise to detect exploitation attempts.<\/p>\n\n\n\n

  Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/a><\/gwmw><\/p>\n\n\n\n

  Pierluigi Paganini<\/strong><\/a><\/gwmw><\/p>\n\n\n\n

  (<\/strong>SecurityAffairs<\/strong><\/a> \u2013<\/strong> hacking, SIEM)<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

  Researchers released a proof-of-concept (PoC) exploit for remote code execution flaw CVE-2024-23108 in Fortinet SIEM solution. Security researchers at Horizon3’s Attack Team released a proof-of-concept (PoC) exploit for a remote code execution issue, tracked as CVE-2024-23108, in Fortinet’s SIEM solution. The PoC exploit allows executing commands as root on Internet-facing FortiSIEM appliances. In February, cybersecurity […]<\/p>\n","protected":false},"author":1,"featured_media":94398,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,5],"tags":[15119,4112,9508,9506,10918,687,7699,841,1533],"class_list":["post-163797","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-hacking","tag-fortinet-siem","tag-hacking","tag-hacking-news","tag-information-security-news","tag-it-information-security","tag-pierluigi-paganini","tag-poc","tag-security-affairs","tag-security-news"],"yoast_head":"\n