CVE-2024-23108
CRITICAL EXPLOITED RANSOMWARE NUCLEIFortinet FortiSIEM - OS Command Injection
Title source: nucleiExploitation Summary
CVE-2024-23108 has been observed exploited in the wild (reported by VulnCheck KEV), including in ransomware campaigns. EIP tracks 2 public exploits from researchers including horizon3ai, hitem. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a functional Python exploit for CVE-2024-23108, demonstrating unauthenticated command injection in Fortinet FortiSIEM via crafted XML payloads sent to the Phoenix Monitor service. The exploit constructs a malicious XML payload with command injection in the mount_point field and sends it over SSL to trigger blind command execution as root.
Description
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.
Exploits (2)
The repository contains a functional Python exploit for CVE-2024-23108, demonstrating unauthenticated command injection in Fortinet FortiSIEM via crafted XML payloads sent to the Phoenix Monitor service. The exploit constructs a malicious XML payload with command injection in the mount_point field and sends it over SSL to trigger blind command execution as root.
This repository contains a functional exploit for CVE-2024-23108, a command injection vulnerability in FortiSIEM appliances. The exploit sends a crafted XML payload to the Phoenix Monitor service on port 7900, allowing blind command execution as root.
Nuclei Templates (1)
port:"7900" || http.favicon.hash:"-1341442175" || http.html:"var hst = location.hostname"
body="var hst = location.hostname" || icon_hash="-1341442175"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H