CVE-2024-52960 Overview
CVE-2024-52960 is a client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox. The flaw allows an authenticated attacker with at least read-only permission to execute unauthorized commands through crafted requests. Affected versions include FortiSandbox 5.0.0, 4.4.0 through 4.4.6, and all releases before 4.2.7. The vulnerability enables privilege escalation because FortiSandbox trusts the client to enforce access controls that should be validated on the server. Fortinet published the advisory tracked as FG-IR-24-305.
Critical Impact
Authenticated attackers with read-only accounts can execute privileged commands, compromising the confidentiality, integrity, and availability of the FortiSandbox appliance.
Affected Products
- Fortinet FortiSandbox 5.0.0
- Fortinet FortiSandbox 4.4.0 through 4.4.6
- Fortinet FortiSandbox versions before 4.2.7
Discovery Timeline
- 2025-03-11 - CVE-2024-52960 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-52960
Vulnerability Analysis
FortiSandbox is Fortinet's dynamic malware analysis appliance used to detonate suspicious files and URLs. The vulnerability is categorized as CWE-602: Client-Side Enforcement of Server-Side Security. The server delegates authorization checks to the client, allowing crafted requests to bypass permission boundaries. An attacker holding a read-only account can issue requests that the server executes as if they were authorized administrative operations. The result is unauthorized command execution on an appliance that routinely handles sensitive samples and organizational threat intelligence.
Root Cause
The root cause is trust misplacement between the client and the server. The FortiSandbox web interface enforces role-based restrictions in the browser layer rather than validating each command against the caller's role on the server. When a client submits a request directly, the missing server-side check permits actions reserved for higher-privileged roles. This weakness pattern converts any authenticated read-only session into a foothold for privileged command execution.
Attack Vector
Exploitation requires network access to the FortiSandbox management interface and valid credentials for any account, including a read-only user. The attacker sends crafted HTTP requests that mimic administrative operations while bypassing UI-level restrictions. Because the server does not re-validate authorization, the requests execute successfully. No user interaction is required beyond the attacker's own authenticated session. Refer to the Fortinet Security Advisory FG-IR-24-305 for vendor-supplied technical detail.
Verified proof-of-concept code is not publicly available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-52960
Indicators of Compromise
- Administrative or configuration-changing API calls originating from accounts provisioned with read-only roles.
- Unexpected command execution events, new administrator accounts, or configuration changes on the FortiSandbox appliance.
- HTTP requests to FortiSandbox management endpoints containing parameters that do not match the caller's assigned role.
Detection Strategies
- Compare each authenticated request against the initiating user's role and alert on privilege mismatches recorded in FortiSandbox audit logs.
- Baseline normal read-only account behavior and flag deviations such as write operations, job submissions with elevated parameters, or system commands.
- Correlate authentication events from FortiSandbox with subsequent configuration changes to identify sessions that escalate scope after login.
Monitoring Recommendations
- Forward FortiSandbox syslog and audit events to a centralized SIEM for role-based anomaly analysis.
- Enable verbose logging on the FortiSandbox management interface to capture request metadata, source IP, and user role.
- Monitor for external network access to the FortiSandbox administrative interface and restrict it to trusted management networks.
How to Mitigate CVE-2024-52960
Immediate Actions Required
- Upgrade FortiSandbox to a fixed release as specified in Fortinet advisory FG-IR-24-305.
- Audit all FortiSandbox local and remote accounts, removing unused read-only users and rotating credentials for active accounts.
- Restrict management interface access to a dedicated administrative network segment using firewall policies.
Patch Information
Fortinet has released fixed versions of FortiSandbox that remediate CVE-2024-52960. Administrators should review Fortinet Security Advisory FG-IR-24-305 for the exact upgrade paths applicable to 4.2.x, 4.4.x, and 5.0.x branches, then plan an upgrade window that preserves sandbox analysis job state.
Workarounds
- Limit FortiSandbox administrative access to trusted IP ranges using trusted host restrictions on each user account.
- Enforce multi-factor authentication for all FortiSandbox administrator and read-only accounts to raise the cost of credential-based exploitation.
- Disable or remove read-only accounts that are not actively required until the appliance is upgraded to a patched release.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
