SecBoard
Zurück zur CVE-Übersicht

CVE-2026-84389

LOW(3.1)

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Risk Signal Score8/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

3.1

Technische Schwere

Beschreibung

A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

// This is a placeholder query. Actual detection for open redirect vulnerabilities requires specific logging of URL redirections and their targets, which is highly application-dependent.
// Look for unusual redirect patterns or redirects to external, untrusted domains from FortiSIEM application logs.
// Example (conceptual, needs adaptation to actual log schema):
// FortiSIEM_Logs
// | where EventType == "URL_Redirect"
// | where TargetURL has_any ("http://evil.com", "https://malicious.org") or TargetURL matches regex @"^(http|https)://[^/]+\.evil\.com"

Splunk SPL

# This is a placeholder query. Actual detection for open redirect vulnerabilities requires specific logging of URL redirections and their targets, which is highly application-dependent.
# Look for unusual redirect patterns or redirects to external, untrusted domains from FortiSIEM application logs.
# Example (conceptual, needs adaptation to actual log schema):
# sourcetype="fortisiem_logs" EventType="URL_Redirect" (TargetURL="http://evil.com" OR TargetURL="https://malicious.org" OR TargetURL=*.evil.com)
# | table _time, source, TargetURL, SourceIP

Sigma

title: FortiSIEM Open Redirect Attempt (Conceptual)
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential open redirect attempts in FortiSIEM by looking for redirects to untrusted domains. This is a conceptual rule and requires specific log sources and field names.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84389
logsource:
  product: fortisiem
  service: application
detection:
  selection:
    EventType: 'URL_Redirect'
    TargetURL|contains:
      - 'http://evil.com'
      - 'https://malicious.org'
      - '.evil.com'
  condition: selection
level: low

Elastic ES|QL

// This is a placeholder query. Actual detection for open redirect vulnerabilities requires specific logging of URL redirections and their targets, which is highly application-dependent.
// Look for unusual redirect patterns or redirects to external, untrusted domains from FortiSIEM application logs.
// Example (conceptual, needs adaptation to actual log schema):
// FROM fortisiem_logs
// WHERE event.type == "URL_Redirect"
// AND (url.full == "http://evil.com" OR url.full == "https://malicious.org" OR url.full LIKE "%.evil.com")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen