A new critical command injection vulnerability, CVE-2024-23108, found in Fortinet’s FortiSIEM solution. This vulnerability poses significant risks to organizations using the solution. Review this Cybersecurity Threat Advisory to learn more now.
What is the threat?
CVE-2024-23108 impacts FortiSIEM versions 6.4.0 and higher. This vulnerability allows remote, unauthenticated attackers to execute commands as the root user on affected systems by sending specially crafted API requests. It originates from the improper neutralization of special elements used in OS commands, which can be manipulated to execute unauthorized commands via the datastore.py script. An attacker can leverage this flaw to gain root access to any Internet-exposed and unpatched FortiSIEM appliances.
Why is it noteworthy?
A proof-of-concept of the vulnerability has been released, making it a target for exploitation in the wild. To exploit the vulnerability, an attacker only needs to send crafted API requests to the targeted FortiSIEM supervisor component. Upon a successful, the attacker can conduct remote command execution as the root user, without authentication. This give the attackers full control over affected systems that can lead to severe security breaches, data theft, and disruption of services.
What is the exposure or risk?
With full control over affected systems, attackers can access sensitive information, manipulate data, disrupt operations, and move laterally to deepen the attack within the system. As organizations rely on FortiSIEM for security monitoring and event management, a successful exploit could lead to severe damage to their systems and compromise the integrity of their security infrastructure.
What are the recommendations?
Barracuda MSP recommends the following actions to reduce the risk of exploitation and protect systems from potential attacks leveraging CVE-2024-23108:
- Apply the latest security patches provided by Fortinet for FortiSIEM versions 6.4.0 and higher.
- Implement strict access control measures.
- Implement comprehensive monitoring and logging solutions.
References
Please visit the following links to learn more about this threat:
- https://www.bleepingcomputer.com/news/security/exploit-released-for-maximum-severity-fortinet-rce-bug-patch-now/
- https://www.helpnetsecurity.com/2024/05/29/cve-2024-23108-cve-2023-34992-poc/
If you have any questions about this Cybersecurity Threat Advisory, please contact Barracuda XDR’s Security Operations Center.
