平台
fortinet
组件
fortinet-fortisandbox
修复版本
4.4.3
4.2.9
4.0.7
3.2.5
3.1.6
CVE-2023-45587 describes a cross-site scripting (XSS) vulnerability present in Fortinet FortiSandbox. This flaw allows an attacker to inject malicious scripts into web pages, potentially leading to unauthorized code execution. The vulnerability impacts versions 3.1.0 through 4.4.2 of FortiSandbox, and a patch is available from Fortinet.
Successful exploitation of CVE-2023-45587 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the FortiSandbox web interface. This could lead to session hijacking, credential theft, or defacement of the web interface. An attacker could potentially gain access to sensitive data processed by FortiSandbox, or use the vulnerability as a stepping stone to compromise other systems within the network if the FortiSandbox is configured with overly permissive access controls. The impact is amplified if the FortiSandbox is used to analyze critical network traffic, as an attacker could potentially manipulate the analysis process.
CVE-2023-45587 was publicly disclosed on December 13, 2023. While no active exploitation campaigns have been publicly confirmed, the ease of XSS exploitation means it remains a potential threat. There are no known public proof-of-concept exploits available at this time. The vulnerability has been added to the CISA KEV catalog, indicating a potential risk to federal information systems.
Organizations heavily reliant on Fortinet FortiSandbox for network security and malware analysis are particularly at risk. Environments with legacy FortiSandbox deployments or those that haven't implemented robust input validation practices are also more vulnerable. Shared hosting environments where multiple users share a FortiSandbox instance could be affected if one user is compromised.
• fortinet / web:
curl -I <fortisandbox_url> | grep -i 'X-XSS-Protection'• fortinet / web:
curl -I <fortisandbox_url> | grep -i 'Content-Security-Policy'• fortinet / web: Check FortiSandbox logs for unusual HTTP requests containing script tags or event handlers. • fortinet / web: Examine FortiSandbox configuration for overly permissive access controls or insecure settings.
disclosure
漏洞利用状态
EPSS
0.44% (63% 百分位)
CVSS 向量
The primary mitigation for CVE-2023-45587 is to upgrade FortiSandbox to a patched version. Fortinet has released updates to address this vulnerability. If immediate patching is not possible, consider implementing strict input validation and output encoding on the FortiSandbox web interface to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide a temporary layer of protection. Regularly review FortiSandbox configuration to ensure least privilege access.
Actualice FortiSandbox a una versión posterior a la 4.4.2, 4.2.8, 4.0.6, 3.2.4 o 3.1.5, según corresponda a su versión actual. Consulte el aviso de seguridad de Fortinet para obtener más detalles e instrucciones específicas de actualización.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2023-45587 is a cross-site scripting (XSS) vulnerability in Fortinet FortiSandbox versions 3.1.0–4.4.2, allowing attackers to execute malicious scripts.
If you are running Fortinet FortiSandbox versions 3.1.0 through 4.4.2, you are potentially affected by this vulnerability.
Upgrade to a patched version of Fortinet FortiSandbox as soon as possible. Refer to the Fortinet advisory for specific version details.
While no active exploitation campaigns have been publicly confirmed, the vulnerability remains a potential threat due to the ease of XSS exploitation.
Refer to the official Fortinet security advisory for detailed information and patching instructions: [https://fortinet.com/security/advisory/fo45587](https://fortinet.com/security/advisory/fo45587)