CVE-2023-34993
published 2023-10-10CVE-2023-34993: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through…
PriorityP190critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
18.15%
96.8th percentile
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortinet | — | — |
| fortinet | fortiwlm | — | — |
| fortinet | fortiwlm | 8.5.0 – 8.5.4 | — |
| fortinet | fortiwlm | 8.6.0 – 8.6.5 | — |
Detection & IOCsextracted from sources · hover to see the quote
url/ems/cgi-bin/ezrf_upgrade_images.cgi?op_type=deleteprogressfile&progressfile=
path/ems/cgi-bin/ezrf_upgrade_images.cgi
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Fortinet FortiWLM Unauthenticated Command Injection (CVE-2023-34993)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/ems/cgi-bin/ezrf_upgrade_images.cgi"; fast_pattern; content:"op_type=deleteprogressfile"; content:"progressfile|3d|"; pcre:"/^[^&]*?[\x3b\x0a\x26\x60\x7c\x24]/R"; reference:url,www.horizon3.ai/attack-research/attack-blogs/fortiwlm-the-almost-story-for-the-forti-forty; reference:cve,2023-34993; classtype:web-application-attack; sid:2058405; rev:1; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2024_12_19, cve CVE_2023_34993, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2024_12_19, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Exploit targets HTTP GET requests to /ems/cgi-bin/ezrf_upgrade_images.cgi with op_type=deleteprogressfile; inject OS command characters (;, newline, &, backtick, |, $) in the progressfile parameter.
- →Exploitation is unauthenticated — no prior authentication required; monitor for unexpected outbound curl/HTTP callbacks from the FortiWLM host following requests to the vulnerable CGI endpoint.
- →Shodan/FOFA fingerprinting queries for exposed FortiWLM instances: search for http.title:"FortiWLM", http.html:"fortiwlm", or body="fortiwlm".
- →Proof-of-concept injection payload appends a semicolon followed by a curl command to the progressfile parameter, confirming OOB (out-of-band) command execution via DNS/HTTP callback.
- →Snort/Suricata rule SID 2058405 (ET, created 2024-12-19) detects this exploit in-line; requires TLS decryption (TLSDecrypt) for encrypted traffic inspection.
- ·The Snort/ET rule (SID 2058405) requires TLS decryption to be effective against HTTPS-wrapped traffic targeting FortiWLM.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hp4r-wh6m-675v: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8
ghsa_unreviewed·2023-10-10
CVE-2023-34993 [CRITICAL] CWE-78 GHSA-hp4r-wh6m-675v: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
VulnCheck
Fortinet fortiwlm Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2023·CVSS 9.8
CVE-2023-34993 [CRITICAL] Fortinet fortiwlm Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Fortinet fortiwlm Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
Affected: Fortinet fortiwlm
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-14&host_type=src&vulnerability=cve-2023-34993; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability
Fortinet
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM versio...
vendor_fortinet·2023-10-10·CVSS 9.8
CVE-2023-34993 [CRITICAL] CWE-78 A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM versio...
FG-IR-23-140: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM versio...
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
CVEs: CVE-2023-34993, CVE-2023-36547, CVE-2023-36548, CVE-2023-36549, CVE-2023-36550
CWEs: CWE-78
CVSS: 9.8 (critical)
Affected products: FortiWLM, FortiWlm, Fortinet
Suricata
ET WEB_SPECIFIC_APPS Fortinet FortiWLM Unauthenticated Command Injection (CVE-2023-34993)
suricata·2024-12-19·CVSS 9.8
CVE-2023-34993 [CRITICAL] ET WEB_SPECIFIC_APPS Fortinet FortiWLM Unauthenticated Command Injection (CVE-2023-34993)
ET WEB_SPECIFIC_APPS Fortinet FortiWLM Unauthenticated Command Injection (CVE-2023-34993)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Fortinet FortiWLM Unauthenticated Command Injection (CVE-2023-34993)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/ems/cgi-bin/ezrf_upgrade_images.cgi"; fast_pattern; content:"op_type=deleteprogressfile"; content:"progressfile|3d|"; pcre:"/^[^&]*?[\x3b\x0a\x26\x60\x7c\x24]/R"; reference:url,www.horizon3.ai/attack-research/attack-blogs/fortiwlm-the-almost-story-for-the-forti-forty; reference:cve,2023-34993; classtype:web-application-attack; sid:2058405; rev:1; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2024_12_19, cve CVE_2023_34993, deployment Perimeter, deployment Inter
Nuclei
Fortinet FortiWLM Unauthenticated Command Injection Vulnerability
nuclei·CVSS 9.8
CVE-2023-34993 [CRITICAL] Fortinet FortiWLM Unauthenticated Command Injection Vulnerability
Fortinet FortiWLM Unauthenticated Command Injection Vulnerability
A improper neutralization of special elements used in an os command ('os
command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and
8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands
Successful exploitation of this vulnerability could allow an attacker to
bypass authentication and gain unauthorized access to the affected system.
Template:
id: CVE-2023-34993
info:
name: Fortinet FortiWLM Unauthenticated Command Injection Vulnerability
author: dwisiswant0
severity: critical
description: |
A improper neutralization of special elements used in an os command ('os
command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and
8.5.0 through 8.5.4 allows attacker to execute unaut
No writeups or analysis indexed.
2023-10-10
Published
Exploited in the wild