SecBoard
Zurück zur CVE-Übersicht

CVE-2025-46773

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score22/100 — NIEDRIG
  • CVSS 8.8 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects attempts by low-privileged users to execute arbitrary commands via crafted requests, indicative of SQL Injection. Focus on unusual command execution patterns originating from FortiAnalyzer processes.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in ("FortiAnalyzer.exe", "FortiAnalyzerCloud.exe")
| where FileName in ("cmd.exe", "powershell.exe", "sh", "bash")
| where ProcessCommandLine contains "-c" or ProcessCommandLine contains "/c"
| where InitiatingProcessIntegrityLevel == "Low"
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName

Splunk SPL

index=your_fortianalyzer_logs sourcetype=fortianalyzer_process_events (InitiatingProcessFileName="FortiAnalyzer.exe" OR InitiatingProcessFileName="FortiAnalyzerCloud.exe") (FileName="cmd.exe" OR FileName="powershell.exe" OR FileName="sh" OR FileName="bash") (ProcessCommandLine="*-c*" OR ProcessCommandLine="*/c*") InitiatingProcessIntegrityLevel="Low" | stats count by host, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName

Sigma

title: FortiAnalyzer SQLi Command Execution
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects potential command execution via SQL Injection in FortiAnalyzer/FortiAnalyzer Cloud by low-privileged processes.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
  service: security
detection:
  selection:
    ParentImage|endswith:
      - '\FortiAnalyzer.exe'
      - '\FortiAnalyzerCloud.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh'
      - '\bash'
    CommandLine|contains:
      - ' -c '
      - ' /c '
  condition: selection

Elastic ES|QL

from process where 
  (process.parent.executable : "*FortiAnalyzer.exe" or process.parent.executable : "*FortiAnalyzerCloud.exe") and 
  (process.executable : "*cmd.exe" or process.executable : "*powershell.exe" or process.executable : "*sh" or process.executable : "*bash") and 
  (process.args : "-c" or process.args : "/c") and 
  process.parent.integrity_level : "low"
| stats count() by host.name, process.parent.executable, process.executable, process.command_line, process.parent.name

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen