CVE-2024-47572: Fortinet FortiSOAR RCE Vulnerability

CVE-2024-47572 Overview

CVE-2024-47572 is a CSV formula injection vulnerability affecting Fortinet FortiSOAR versions 7.2.1 through 7.4.1. The flaw stems from improper neutralization of formula elements written to CSV files [CWE-1236]. An attacker with low privileges can craft malicious input that becomes an executable formula when the exported CSV is opened in a spreadsheet application. Successful exploitation allows execution of unauthorized code or commands on the victim's workstation.

Critical Impact
Attackers can execute arbitrary commands on a user's system by injecting spreadsheet formulas into CSV exports produced by FortiSOAR.

Affected Products

Fortinet FortiSOAR 7.2.1
Fortinet FortiSOAR 7.3.x
Fortinet FortiSOAR through 7.4.1

Discovery Timeline

2025-01-14 - CVE-2024-47572 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47572

Vulnerability Analysis

CVE-2024-47572 is a CSV injection flaw, also known as formula injection. FortiSOAR generates CSV exports containing user-controlled field values without stripping or escaping leading formula characters such as =, +, -, and @. When a downstream user opens the exported file in Microsoft Excel, LibreOffice Calc, or a similar spreadsheet application, the crafted cell is interpreted as a formula rather than data.

The vulnerability requires authenticated access with low privileges to inject the payload, and user interaction to open the resulting export. The attack impacts confidentiality, integrity, and availability of the host that renders the CSV. Spreadsheet features such as DDE, HYPERLINK, and WEBSERVICE can be abused to trigger command execution, exfiltrate data, or pivot to further compromise.

Root Cause

The root cause is the absence of output encoding on CSV cell values. FortiSOAR does not prefix or sanitize fields beginning with formula trigger characters. This falls under CWE-1236: Improper Neutralization of Formula Elements in a CSV File.

Attack Vector

An authenticated attacker submits data through a FortiSOAR interface, such as an alert field, incident note, or record attribute, that begins with a formula character followed by a malicious payload. A legitimate operator later exports the record set to CSV and opens the file. The spreadsheet engine parses the cell as a formula and executes the embedded logic in the operator's context.

No verified public exploit is available for CVE-2024-47572. See the Fortinet Security Advisory FG-IR-24-210 for vendor technical details.

Detection Methods for CVE-2024-47572

Indicators of Compromise

CSV files exported from FortiSOAR containing cells starting with =, +, -, or @ followed by functions such as cmd, DDE, HYPERLINK, or WEBSERVICE.
Spreadsheet processes such as excel.exe spawning child processes like cmd.exe, powershell.exe, or mshta.exe shortly after opening a FortiSOAR export.
Outbound network requests from spreadsheet applications to attacker-controlled hosts, indicating exfiltration via WEBSERVICE or HYPERLINK.

Detection Strategies

Inspect FortiSOAR record fields and exports for values beginning with formula trigger characters, particularly in free-text fields submitted by low-privilege users.
Correlate export events in FortiSOAR audit logs with subsequent process creation events on analyst workstations to identify formula execution.
Deploy endpoint detection rules that flag Office applications spawning shells or scripting hosts, a common post-exploitation pattern for CSV injection.

Monitoring Recommendations

Monitor FortiSOAR export activity and log the identity of users who submit records exported to CSV.
Alert on spreadsheet processes making outbound HTTP requests or invoking DDE handlers.
Review data ingestion pipelines feeding FortiSOAR for untrusted sources that can seed formula payloads into stored records.

How to Mitigate CVE-2024-47572

Immediate Actions Required

Upgrade Fortinet FortiSOAR to a fixed release as directed by the Fortinet Security Advisory FG-IR-24-210.
Restrict export permissions to trusted analyst roles until patching is complete.
Instruct users to open FortiSOAR CSV exports only in applications configured to disable automatic formula evaluation and external content.

Patch Information

Fortinet has published remediation guidance in advisory FG-IR-24-210. Administrators should consult the advisory for the exact fixed versions and upgrade paths applicable to their FortiSOAR 7.2.1 through 7.4.1 deployments.

Workarounds

Sanitize record fields prior to export by prefixing cells beginning with =, +, -, or @ with a single quote to force literal interpretation.
Disable Dynamic Data Exchange (DDE) and external content in Microsoft Excel via Group Policy on analyst workstations.
Route CSV exports through a review process that scans for formula trigger characters before distribution.

bash

# Example: sanitize a FortiSOAR CSV export by neutralizing formula prefixes
awk 'BEGIN{FS=OFS=","} {
  for (i=1; i<=NF; i++) {
    if ($i ~ /^[=+\-@]/) {
      $i = "'\''" $i
    }
  }
  print
}' fortisoar_export.csv > fortisoar_export_safe.csv