CVE-2024-23108
📋 TL;DR
This CVE describes an OS command injection vulnerability in Fortinet products that allows attackers to execute arbitrary commands via crafted API requests. Attackers can achieve remote code execution with the privileges of the vulnerable service. Organizations using affected Fortinet products are at risk.
💻 Affected Systems
- Fortinet FortiOS
- Fortinet FortiProxy
📦 What is this software?
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data exfiltration, lateral movement, ransomware deployment, or persistent backdoor installation.
Likely Case
Unauthorized command execution leading to configuration changes, credential harvesting, or initial foothold for further attacks.
If Mitigated
Limited impact due to network segmentation, API access restrictions, and proper authentication controls.
🎯 Exploit Status
Exploit requires valid API credentials. Public proof-of-concept available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiOS 7.4.3, 7.2.7, 7.0.14, 6.4.15, 6.2.16, 6.0.18; FortiProxy 7.4.3, 7.2.9, 7.0.15
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-23-130
Restart Required: Yes
Instructions:
1. Download appropriate firmware version from Fortinet support portal. 2. Backup configuration. 3. Apply firmware update via GUI or CLI. 4. Reboot device. 5. Verify update success.
🔧 Temporary Workarounds
Restrict API Access
allLimit API access to trusted IP addresses only
config system api-user
edit <user>
set trusthost <trusted_ip>
end
Disable Unused APIs
allDisable API endpoints not required for operations
config system api-user
edit <user>
set accprofile <restricted_profile>
end
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices
- Enable API authentication with strong credentials and MFA where possible
🔍 How to Verify
Check if Vulnerable:
Check FortiOS/FortiProxy version via CLI: get system status | grep VersionCheck Version:
get system status | grep VersionVerify Fix Applied:
Verify version is patched: get system status | grep Version and confirm version >= patched versions📡 Detection & Monitoring
Log Indicators:
- Unusual API requests with command injection patterns
- Multiple failed API authentication attempts followed by successful exploitation
- Execution of unexpected system commands
Network Indicators:
- Unusual outbound connections from Fortinet devices
- Traffic to unexpected destinations
SIEM Query:
source="fortigate" AND ("api" AND ("exec" OR "system" OR "command"))