Fortinet FortiManager 身份认证绕过漏洞（CVE-2024-47575）

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.fortiguard.com/psirt/FG-IR-24-423
• https://nvd.nist.gov/vuln/detail/CVE-2024-47575
• https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/FortiManager/FortiManager%E8%BA%AB%E4%BB%BD%E8%AE%A4%E8%AF%81%E7%BB%95%E8%BF%87%E6%BC%8F%E6%B4%9E(CVE-2024-47575).md
• https://avd.aliyun.com/detail?id=AVD-2024-47575
• https://www.secrss.com/articles/71607
• https://cloud.tencent.com/developer/article/2549714
• https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575
• https://cloud.google.com/blog/topics/threat-intelligence/fortimanager-zero-day-exploitation-cve-2024-47575
• https://labs.watchtowr.com/hop-skip-fortijump-fortijumphigher-cve-2024-23113-cve-2024-47575/
• https://www.rapid7.com/blog/post/2024/10/23/etr-fortinet-fortimanager-cve-2024-47575-exploited-in-zero-day-attacks/

Related Vulnerabilities

• PoCCVE-2026-39808: Fortinet FortiSandbox - Command Injection
• Fortinet FortiSandbox /fortisandbox/job-detail/tracer-behavior 命令执行漏洞（CVE-2026-39808）
• PoCCVE-2026-21643: Fortinet FortiClientEMS 7.4.4 - SQL Injection
• PoCCVE-2025-52970: Fortinet FortiWeb - Authentication Bypass to Admin Privilege
• Fortinet FortiOS等 签名验证不当漏洞
• Fortinet FortiWeb /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi 权限绕过漏洞（CVE-2025-64446/CVE-2025-58034）
• Fortinet FortiWeb 需授权 命令注入漏洞
• Fortinet FortiWeb /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi 权限绕过漏洞（CVE-2025-64446）
• PoCFortinet FortiWeb 未授权身份验证绕过漏洞（CVE-2025-64446）