FortiSIEM phMonitor Second-Order Command Injection

This repository contains a proof-of-concept (POC) exploit for CVE-2024-23108, a command injection vulnerability in Fortinet FortiSIEM appliances. The main file, CVE-2024-23108.py, is a Python script that connects to the Phoenix Monitor service (default port 7900) over SSL and sends a crafted XML payload. The payload injects an arbitrary shell command into the 'mount_point' field, exploiting the vulnerability to execute the command as root on the target system. The script supports targeting a single IP or a list of IPs and provides colored output for success and error messages. The README.md provides usage instructions, background, and references. The exploit is operational as a POC, requiring the attacker to specify the command to execute and the target(s). No hardcoded payloads are present; the exploit is interactive and flexible. The main attack vector is network-based, targeting the Phoenix Monitor service on FortiSIEM appliances.

This repository contains a proof-of-concept exploit for CVE-2024-23108, a 2nd order unauthenticated command injection vulnerability in Fortinet FortiSIEM appliances. The main file, CVE-2024-23108.py, is a Python script that crafts a malicious XML payload containing an attacker-supplied command and sends it over an SSL/TLS connection to the Phoenix Monitor service (default port 7900) on the target system. The exploit allows for blind command execution as root. The script takes command-line arguments for the target IP, port, and the command to execute. The README provides usage instructions and background information. No hardcoded external endpoints are present, but the exploit targets a network service on the victim appliance. The repository is structured simply, with one exploit script and a README.