SecBoard
Zurück zur CVE-Übersicht

CVE-2026-23706

MEDIUM(6.5)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Risk Signal Score16/100 — NIEDRIG
  • CVSS 6.5 — Mittel

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

6.5

Technische Schwere

Beschreibung

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.2.1 through 7.2.9, FortiManager 7.6.0 through 7.6.2, FortiManager 7.4.0 through 7.4.6 may allow a low privileged user to execute arbitrary commands via crafted requests.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects attempts by low-privileged users to execute arbitrary commands via crafted requests, indicative of SQL Injection exploitation.

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4688 // Process Creation
| where ParentProcessName has_any ("FortiAnalyzer", "FortiManager")
| where CommandLine has_any ("cmd.exe", "powershell.exe", "sh", "bash") // Example commands, customize as needed
| where SubjectUserSid != "S-1-5-18" // Exclude SYSTEM account, focus on low-privileged users
| project TimeGenerated, ComputerName, AccountName, ParentProcessName, CommandLine, ProcessId

Splunk SPL

index=* (sourcetype=fortianalyzer OR sourcetype=fortimanager) (cmd.exe OR powershell.exe OR sh OR bash) | where user!= "SYSTEM" | table _time, host, user, parent_process, command

Sigma

title: FortiAnalyzer/FortiManager SQLi Command Execution
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential command execution via SQL Injection in FortiAnalyzer/FortiManager by monitoring suspicious process creations.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentProcessName|contains: ['FortiAnalyzer', 'FortiManager']
    CommandLine|contains: ['cmd.exe', 'powershell.exe', 'sh', 'bash']
    User|!contains: 'SYSTEM'
  condition: selection
level: high

Elastic ES|QL

from process where event.category == "process" and event.type == "start" and (process.parent.name : ("FortiAnalyzer", "FortiManager")) and (process.command_line : ("cmd.exe", "powershell.exe", "sh", "bash")) and not (user.name : "SYSTEM")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen