Security researchers have unveiled a proof-of-concept (PoC) exploit for a top-level vulnerability in Fortinet's security information and event management (SIEM) solution, FortiSIEM. Although the company patched this vulnerability in February, it's imperative for users to update their systems immediately to prevent potential attacks.
The vulnerability, tracked as CVE-2024-23108, is a command injection flaw discovered and reported by Horizon3 vulnerability expert Zach Hanley. This flaw allows remote command execution as root without requiring authentication.
Fortinet explains, "Multiple improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiSIEM supervisor may allow a remote unauthenticated attacker to execute unauthorized commands via crafted API requests."
The CVE-2024-23108 impacts FortiClient FortiSIEM versions 6.4.0 and higher and was patched by the company on February 8, alongside a second RCE vulnerability (CVE-2024-23109) with a maximum severity score.
After initially denying the existence of these two CVEs and claiming they were duplicates of a similar flaw (CVE-2023-34992) fixed in October, Fortinet admitted that they were indeed variants of CVE-2023-34992 with the same description as the original vulnerability.
On Tuesday, over three months after Fortinet released security updates to patch this flaw, Horizon3's Attack Team shared a PoC exploit and published a detailed technical analysis.
Horizon3's PoC exploit can execute commands as root on any Internet-exposed and unpatched FortiSIEM appliances. The team also released a PoC exploit for a critical flaw in Fortinet's FortiClient Enterprise Management Server (EMS) software, which is now being actively exploited in attacks.
Fortinet vulnerabilities are frequently exploited—often as zero-days—in ransomware and cyber espionage attacks targeting corporate and government networks. For instance, in February, the company revealed that Chinese Volt Typhoon hackers used two FortiOS SSL VPN flaws to deploy the Coathanger remote access trojan (RAT), a malware strain that was also recently used to backdoor a military network of the Dutch Ministry of Defence.
Given the severity and potential impact of these vulnerabilities, it's crucial for all Fortinet users to ensure their systems are updated with the latest patches to avoid falling victim to potential cyberattacks.
