CVE-2024-23671: Fortinet FortiSandbox Path Traversal Flaw

CVE-2024-23671 Overview

CVE-2024-23671 is a path traversal vulnerability in Fortinet FortiSandbox that allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests. The flaw is classified under CWE-22, improper limitation of a pathname to a restricted directory. Fortinet disclosed the issue in advisory FG-IR-23-454 and released patched builds for the affected 4.0, 4.2, and 4.4 branches. The vulnerability affects the network-accessible management interface and requires low privileges but no user interaction.

Critical Impact
An attacker with low-privileged access can traverse the filesystem through crafted HTTP requests to execute unauthorized code or commands, compromising the integrity and availability of the FortiSandbox appliance.

Affected Products

Fortinet FortiSandbox 4.4.0 through 4.4.3
Fortinet FortiSandbox 4.2.1 through 4.2.6
Fortinet FortiSandbox 4.0.0 through 4.0.4

Discovery Timeline

2024-04-09 - CVE-2024-23671 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23671

Vulnerability Analysis

The vulnerability resides in the HTTP request handling of the FortiSandbox management interface. The application fails to properly sanitize path components supplied in user-controlled request parameters. An authenticated attacker can craft HTTP requests containing directory traversal sequences to reference files outside the intended restricted directory.

Because the traversal reaches components that process or interpret referenced content, it enables unauthorized code or command execution on the appliance. The impact is limited to integrity and availability. Confidentiality is not affected according to the CVSS vector supplied by Fortinet.

FortiSandbox is a network sandboxing appliance used for advanced threat analysis. Successful exploitation subverts the trust boundary of a device positioned to inspect suspicious files across the enterprise.

Root Cause

The root cause is missing or insufficient canonicalization of pathname input in HTTP request handlers. When traversal sequences such as ../ are passed through parameters that map to filesystem paths, the application resolves them without confining the resulting path to the intended base directory. This maps directly to [CWE-22].

Attack Vector

Exploitation requires network access to the FortiSandbox HTTP management interface and valid low-privileged credentials. The attacker submits crafted HTTP requests containing traversal payloads targeting request parameters that are used to build filesystem paths. Because attack complexity is low and no user interaction is required, valid credentials are the primary barrier to exploitation.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 1.159% (64th percentile) as of August 2026.

Detection Methods for CVE-2024-23671

Indicators of Compromise

HTTP requests to the FortiSandbox management interface containing traversal sequences such as ../, ..\, or URL-encoded variants (%2e%2e%2f, %252e%252e%252f).
Unexpected process execution, file creation, or configuration changes on FortiSandbox appliances following administrative HTTP activity.
Authentication events from unusual source addresses immediately preceding malformed or long HTTP request URIs.

Detection Strategies

Inspect FortiSandbox HTTP access logs for requests containing path traversal patterns targeting API endpoints and administrative resources.
Correlate low-privileged account activity with subsequent privileged operations or shell-like behavior on the appliance.
Baseline normal request URI structure for the management interface and alert on deviations, particularly requests referencing paths outside expected directories.

Monitoring Recommendations

Forward FortiSandbox syslog and administrative audit logs to a centralized SIEM for retention and correlation.
Alert on repeated failed or malformed HTTP requests to the management interface from a single source.
Monitor egress from FortiSandbox appliances for unexpected outbound connections that may indicate post-exploitation activity.

How to Mitigate CVE-2024-23671

Immediate Actions Required

Upgrade FortiSandbox to a fixed release per Fortinet advisory FG-IR-23-454: 4.4.4 or later, 4.2.7 or later, or migrate off 4.0.x to a supported fixed branch.
Restrict network access to the FortiSandbox HTTPS management interface to a dedicated management network and known administrator hosts.
Rotate credentials for all FortiSandbox administrative and service accounts, particularly low-privileged accounts that could be leveraged for exploitation.
Review recent HTTP access logs for evidence of traversal patterns predating the patch deployment.

Patch Information

Fortinet released fixed builds addressing this vulnerability. Refer to the FortiGuard PSIRT advisory FG-IR-23-454 for the exact upgrade paths and target versions for each affected branch. Apply the upgrade during a scheduled maintenance window and validate sandbox analysis functionality after the update.

Workarounds

If immediate patching is not possible, disable or firewall the HTTP/HTTPS management interface from all untrusted networks.
Enforce multi-factor authentication and strong password policies on all administrative accounts to raise the exploitation barrier.
Remove or disable unused low-privileged accounts that could serve as an authenticated foothold.

bash

# Example: restrict FortiSandbox management access to a trusted subnet
config system interface
  edit port1
    set allowaccess ping https ssh
    set trusthost 10.0.100.0/24
  next
end