Fortinet FortiSandbox (Multiple Versions)
FortiSandbox is a cybersecurity product made by Fortinet that organisations use to detect malware and advanced threats by running suspicious files and code in an isolated environment before they reach the network.
Root Cause
The flaws exist because FortiSandbox failed to properly validate HTTP requests before acting on them. In the command injection cases, the software passed attacker-supplied input directly to the underlying operating system without sanitising it. In the path traversal case, the JRPC API did not restrict where in the file system an incoming request could reach — allowing authentication to be bypassed entirely.
Attack Vector
An attacker with no account on the system sends a specially crafted HTTP request to an exposed FortiSandbox API endpoint or web UI. For the command injection flaws, the malformed request causes the server to execute attacker-supplied commands with the privileges of the FortiSandbox process. For the path traversal flaw, the crafted request navigates the API into an authentication bypass, granting access without credentials. No user interaction is required. Exploitation has been observed in the wild across all three CVEs within the past 24 hours.
Detection Notes
Check FortiSandbox logs for unexpected or malformed HTTP requests hitting JRPC API endpoints, particularly from external IP addresses. Look for anomalous process creation events on the FortiSandbox host — unexpected child processes spawned by the web service are a strong indicator. Monitor for any authentication events that do not correspond to known user accounts or sessions.
Recommended Actions
- Upgrade FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS to the latest patched versions immediately — all three CVEs have fixes available.
- Restrict access to FortiSandbox management interfaces to trusted IP ranges only, using firewall rules or network segmentation.
- Enable logging on all API endpoints and set alerts for anomalous request patterns or unexpected process execution.