CVE-2024-47572
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code on Fortinet FortiSOAR systems by manipulating CSV files. Attackers can craft malicious CSV files containing formula elements that aren't properly neutralized, leading to command execution. Organizations running FortiSOAR versions 7.2.1 through 7.4.1 are affected.
💻 Affected Systems
- Fortinet FortiSOAR
📦 What is this software?
Fortisoar by Fortinet
Fortisoar by Fortinet
Fortisoar by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the FortiSOAR instance, potentially accessing sensitive security data and using the platform as a foothold into the network.
Likely Case
Unauthorized command execution leading to data exfiltration, lateral movement, or deployment of malware within the security operations environment.
If Mitigated
Limited impact due to network segmentation, strict file upload controls, and proper user access restrictions preventing malicious CSV uploads.
🎯 Exploit Status
Exploitation requires ability to upload CSV files to the FortiSOAR system, which typically requires some level of access. The vulnerability is in formula element processing, making exploitation relatively straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.4.2 and later
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-24-210
Restart Required: Yes
Instructions:
1. Backup FortiSOAR configuration and data. 2. Download FortiSOAR version 7.4.2 or later from Fortinet support portal. 3. Follow Fortinet's upgrade documentation for your deployment type (appliance/virtual). 4. Apply the update and restart services. 5. Verify functionality post-upgrade.
🔧 Temporary Workarounds
Restrict CSV File Uploads
allTemporarily disable or restrict CSV file upload functionality in FortiSOAR until patching can be completed.
Implement File Upload Validation
allAdd external validation layer to scan and sanitize CSV files before they reach FortiSOAR.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FortiSOAR from critical systems
- Enforce least privilege access controls and audit all CSV file upload activities
🔍 How to Verify
Check if Vulnerable:
Check FortiSOAR version via web interface (Admin > System > About) or CLI command 'csadm --version'Check Version:
csadm --versionVerify Fix Applied:
Verify version is 7.4.2 or later and test CSV import functionality with safe test files📡 Detection & Monitoring
Log Indicators:
- Unusual CSV file uploads
- Unexpected command execution in FortiSOAR logs
- Failed CSV import attempts with suspicious content
Network Indicators:
- Unusual outbound connections from FortiSOAR system
- Data exfiltration patterns
SIEM Query:
source="fortisoar" AND (csv_upload OR file_import) AND (error OR suspicious OR formula)