Exploitation Summary
EIP tracks 2 public exploits for CVE-2022-38374. PoCs published by azhurtanov, M4fiaB0y.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2022-38374, which targets FortiADC. The exploit leverages an XSS vulnerability to achieve remote code execution (RCE) by sending a crafted payload that establishes a reverse shell.
Description
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews.
Exploits (2)
This repository contains a functional exploit for CVE-2022-38374, which targets FortiADC. The exploit leverages an XSS vulnerability to achieve remote code execution (RCE) by sending a crafted payload that establishes a reverse shell.
This repository contains a functional exploit for CVE-2022-38374, which chains an XSS vulnerability in FortiADC to achieve remote code execution (RCE) via a reverse shell. The exploit constructs a malicious payload that leverages the AWS scripting interface and uses chunked encoding to bypass input restrictions.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H