CVE-2024-47575 PoC — Fortinet FortiManager 访问控制错误漏洞

Source

https://github.com/XiaomingX/cve-2024-47575-exp

Associated Vulnerability

Title:Fortinet FortiManager 访问控制错误漏洞 (CVE-2024-47575)
Description:A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.

Description

CVE-2024-47575是Fortinet的FortiManager和FortiManager Cloud产品中的一个严重漏洞，源于fgfmsd守护进程缺乏对关键功能的身份验证。

Readme

# cve-2024-47575-poc
CVE-2024-47575是Fortinet的FortiManager和FortiManager Cloud产品中的一个严重漏洞，源于fgfmsd守护进程缺乏对关键功能的身份验证。该漏洞允许未经身份验证的远程攻击者通过特制的请求在受影响的系统上执行任意代码或命令。 

具体而言，fgfmsd负责处理FortiManager与FortiGate设备之间的通信。由于缺乏适当的身份验证机制，攻击者可以利用此漏洞向fgfmsd发送特制请求，绕过安全控制，执行任意命令或代码，从而可能完全控制受影响的系统。 

该漏洞的严重性在于，攻击者无需任何凭证即可远程利用此漏洞，可能导致敏感信息泄露或系统被完全控制。因此，建议受影响的用户尽快更新到修复版本或采取厂商提供的缓解措施。

File Snapshot


 [4.0K]  /data/pocs/e36c604911b280bb4242303ccb203ef2245763db
├── [4.2K]  CVE-2024-47575-poc.py
├── [ 11K]  LICENSE
├── [ 835]  README.md
├── [1.3K]  w00t_cert.bin
└── [1.6K]  w00t_key.bin

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!