An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all

Successful exploitation of CVE-2023-45587 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the FortiSandbox web interface. This could lead to session hijacking, credential theft, or defacement of the web interface. An attacker could potentially gain access to sensitive data processed by FortiSandbox, or use the vulnerability as a stepping stone to compromise other systems within the network if the FortiSandbox is configured with overly permissive access controls. The impact is amplified if the FortiSandbox is used to analyze critical network traffic, as an attacker could potentially manipulate the analysis process.

Organizations heavily reliant on Fortinet FortiSandbox for network security and malware analysis are particularly at risk. Environments with legacy FortiSandbox deployments or those that haven't implemented robust input validation practices are also more vulnerable. Shared hosting environments where multiple users share a FortiSandbox instance could be affected if one user is compromised.

• fortinet / web:

curl -I <fortisandbox_url> | grep -i 'X-XSS-Protection'

• fortinet / web:

curl -I <fortisandbox_url> | grep -i 'Content-Security-Policy'

• fortinet / web: Check FortiSandbox logs for unusual HTTP requests containing script tags or event handlers. • fortinet / web: Examine FortiSandbox configuration for overly permissive access controls or insecure settings.

1. 2023-12-13Disclosure

   disclosure

1. आरक्षित2023-10-09
2. प्रकाशित2023-12-13
3. संशोधित2026-01-14
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2023-45587 is to upgrade FortiSandbox to a patched version. Fortinet has released updates to address this vulnerability. If immediate patching is not possible, consider implementing strict input validation and output encoding on the FortiSandbox web interface to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide a temporary layer of protection. Regularly review FortiSandbox configuration to ensure least privilege access.