CVE-2024-45328
📋 TL;DR
This vulnerability allows low-privileged administrators in FortiSandbox to execute elevated CLI commands through the GUI console menu due to incorrect authorization checks. It affects FortiSandbox versions 4.4.0 through 4.4.6. Attackers with low-privileged admin access can potentially gain higher privileges and compromise the system.
💻 Affected Systems
- FortiSandbox
📦 What is this software?
Fortisandbox by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
A low-privileged administrator gains full administrative control, modifies system configurations, accesses sensitive data, or installs malware on the FortiSandbox appliance.
Likely Case
Privilege escalation allowing unauthorized access to restricted functions, configuration changes, or data exfiltration within the FortiSandbox environment.
If Mitigated
Limited impact if proper network segmentation, monitoring, and least-privilege access controls are implemented to restrict low-privileged admin access.
🎯 Exploit Status
Exploitation requires authenticated low-privileged admin access. The vulnerability is in the authorization logic of the GUI console menu.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiSandbox 4.4.7 or later
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-24-261
Restart Required: No
Instructions:
1. Log into FortiSandbox GUI as administrator. 2. Navigate to System > Dashboard. 3. Check for available firmware updates. 4. Download and install FortiSandbox 4.4.7 or later. 5. Verify the update completes successfully.
🔧 Temporary Workarounds
Restrict Low-Privileged Admin Access
allTemporarily remove or restrict low-privileged administrator accounts until patching can be completed.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FortiSandbox from critical systems.
- Enhance monitoring of administrator activities and CLI command execution in logs.
🔍 How to Verify
Check if Vulnerable:
Check FortiSandbox version via GUI: System > Dashboard > System Information, or CLI: get system statusCheck Version:
get system status | grep VersionVerify Fix Applied:
Confirm version is 4.4.7 or later via System > Dashboard > System Information📡 Detection & Monitoring
Log Indicators:
- Unusual CLI command execution by low-privileged administrators
- Authorization failures or privilege escalation attempts in system logs
Network Indicators:
- Anomalous administrative traffic patterns to FortiSandbox GUI
SIEM Query:
source="fortisandbox" AND (event_type="admin_login" OR event_type="cli_command") AND user_role="low_privileged"