CVE-2024-23108: Fortinet FortiSIEM RCE Vulnerability

CVE-2024-23108 Overview

CVE-2024-23108 is a critical OS command injection vulnerability affecting Fortinet FortiSIEM, a Security Information and Event Management (SIEM) solution widely deployed in enterprise environments for security monitoring and threat detection. This vulnerability allows remote, unauthenticated attackers to execute arbitrary operating system commands on the underlying server through specially crafted API requests.

The vulnerability stems from improper neutralization of special elements used in OS commands (CWE-78), enabling threat actors to bypass security controls and achieve complete system compromise without requiring authentication.

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands with elevated privileges on FortiSIEM servers, potentially leading to complete infrastructure compromise, data exfiltration, and lateral movement within enterprise networks.

Affected Products

• Fortinet FortiSIEM 7.1.0
• Fortinet FortiSIEM 7.1.1
• Fortinet FortiSIEM (multiple earlier versions)

Discovery Timeline

• February 5, 2024 - CVE-2024-23108 published to NVD
• January 14, 2026 - Last updated in NVD database

Technical Details for CVE-2024-23108

Vulnerability Analysis

This OS command injection vulnerability exists within the FortiSIEM API handling mechanisms. The application fails to properly sanitize user-supplied input before incorporating it into system commands executed on the underlying operating system. This allows attackers to inject malicious command sequences through crafted API requests.

The vulnerability is particularly dangerous because it requires no authentication, meaning any network-accessible FortiSIEM instance is potentially vulnerable. Successful exploitation grants attackers the ability to execute arbitrary commands with the privileges of the FortiSIEM service, typically running with elevated permissions.

Given that FortiSIEM is a security monitoring solution, compromising it could allow attackers to disable alerting mechanisms, tamper with security logs, and establish persistent access while evading detection.

Root Cause

The root cause is improper input validation and sanitization in the FortiSIEM API request processing code. User-controlled input from API requests is passed to OS command execution functions without adequate neutralization of special characters and command separators. This allows attackers to break out of the intended command context and inject additional commands.

Attack Vector

The attack is network-based, requiring no authentication or user interaction. Attackers can exploit this vulnerability by sending specially crafted HTTP API requests to vulnerable FortiSIEM instances. The malicious payload embedded in the request bypasses insufficient input validation and gets executed as an OS command on the target system.

The attack scenario involves:

1. Identifying an exposed FortiSIEM instance
2. Crafting a malicious API request with embedded OS commands
3. Sending the request to the target server
4. Achieving command execution with FortiSIEM service privileges

A proof-of-concept exploit has been published by Horizon3.ai, demonstrating the practical exploitability of this vulnerability. For technical details on the exploitation mechanism, refer to the Horizon3.ai CVE-2024-23108 PoC repository.

Detection Methods for CVE-2024-23108

Indicators of Compromise

• Unusual child processes spawned by FortiSIEM service processes
• Unexpected outbound network connections from FortiSIEM servers
• Anomalous API request patterns in FortiSIEM access logs, particularly requests with special characters or command sequences
• Evidence of reconnaissance commands (whoami, id, uname, cat /etc/passwd) in process logs

Detection Strategies

• Monitor FortiSIEM API access logs for requests containing shell metacharacters such as ;, |, &, $(), and backticks
• Implement network-based detection for malicious payloads targeting the vulnerable API endpoints
• Deploy endpoint detection and response (EDR) solutions to identify suspicious command execution originating from FortiSIEM processes
• Correlate network traffic anomalies with system-level process creation events on FortiSIEM servers

Monitoring Recommendations

• Enable verbose API logging on FortiSIEM instances to capture full request details
• Configure alerts for any command execution by FortiSIEM service accounts outside normal operational patterns
• Implement network segmentation monitoring to detect lateral movement attempts from compromised SIEM infrastructure
• Review FortiSIEM server integrity regularly using file integrity monitoring solutions

How to Mitigate CVE-2024-23108

Immediate Actions Required

• Apply the official security patch from Fortinet immediately
• Restrict network access to FortiSIEM management interfaces using firewall rules
• Implement Web Application Firewall (WAF) rules to filter malicious API requests
• Audit FortiSIEM servers for signs of compromise before patching

Patch Information

Fortinet has released security updates to address this vulnerability. Organizations should consult the FortiGuard Security Advisory FG-IR-23-130 for detailed patch information and upgrade guidance. Ensure FortiSIEM installations are updated to a version that addresses this vulnerability.

Workarounds

• Implement strict network access controls limiting API access to trusted IP addresses only
• Deploy a reverse proxy or WAF in front of FortiSIEM to filter malicious requests
• Disable or restrict unnecessary API endpoints until patching is complete
• Increase monitoring and logging of FortiSIEM servers to detect exploitation attempts

# Example: Restrict FortiSIEM API access to trusted management network only
# Add to firewall configuration
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP