PSIRTOs command injection on vm download feature
Summary
An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiSandbox may allow an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.
| Version | Affected | Solution |
|---|---|---|
| FortiSandbox 5.0 | 5.0.0 | Upgrade to 5.0.1 or above |
| FortiSandbox 4.4 | 4.4.0 through 4.4.6 | Upgrade to 4.4.7 or above |
| FortiSandbox 4.2 | 4.2.1 through 4.2.7 | Upgrade to 4.2.8 or above |
| FortiSandbox 4.0 | 4.0.0 through 4.0.5 | Upgrade to 4.0.6 or above |
| FortiSandbox 3.2 | 3.2 all versions | Migrate to a fixed release |
| FortiSandbox 3.1 | 3.1 all versions | Migrate to a fixed release |
| FortiSandbox 3.0 | 3.0 all versions | Migrate to a fixed release |
Fortinet in Q1/25 has remediated this issue in FortiSandbox Cloud version 24.2 and hence the customers need not perform any action.
Acknowledgement
Internally discovered and reported by Adham El karn of Fortinet Product Security team.Timeline
2025-03-11: Initial publication2025-05-07: Clarify fix information for FortiSandbox Cloud product