CVE-2024-23113 PoC — Fortinet FortiOS 格式化字符串错误漏洞

Source

https://github.com/radoslavatanasov1/CVE-2024-23113

Associated Vulnerability

Title: Fortinet FortiOS 格式化字符串错误漏洞 (CVE-2024-23113)
Description:A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Description

POC TO RCE

Readme

you have to find the correct offsets             payload = b"reply 200\r\nrequest=auth\r\nauthip=<address_of_system> <address_of_command_string>\r\n\r\n\x00"
and place them there, after that the script will sucessfully upload your commands hense RCE

PLEASE DO NOT USE THIS FOR ANY MAL ACTIVICY, I DO THIS FOR FUN AND ANYTHING YOU DO YOURE ON YOUR OWN!

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →