Create CVE-2024-47575.yaml

[zelosleone]

Template / PR Information

• Fortinet FortiManager Unauthenticated RCE #11218 Added
• Added CVE-2024-47575
• References:
• https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575
• https://nvd.nist.gov/vuln/detail/CVE-2024-47575
• https://fortiguard.fortinet.com/psirt/FG-IR-24-423

Steps of Template

• Authenticate using provided credentials (via {{username}} and {{password}} variables).
• Retrieve Serial Numbers and Device Information via JSON-RPC requests.
• Match Log Entries indicative of unauthorized device additions or modifications.
• Identify Suspicious IP Addresses known to be associated with malicious activities.
• Check for Accessible Files (e.g., /tmp/.tm and /var/tmp/.tm) that may indicate tampering, although no known malicious content pattern is assumed according to forticlient, at least not reported yet.

IoCs captured by this template:

• Log Entries: Detects events like "Unregistered device localhost add succeeded" and "Edited device settings (SN FMG-VMTM23017412)"
• Serial Numbers: Matches FMG-VMTM23017412, FMG-VMTM19008093, FGVMEVWG8YMT3R63
• Suspicious IP Addresses: Checks for known malicious IPs provided in the IoC list
• Files: Accesses /tmp/.tm and /var/tmp/.tm to confirm their accessibility (may not appear in all cases)

The template does not attempt exploitation; it merely detects IoCs and suspicious conditions.

Also, I used Fortimanager's API Documents specially for this, it would be great to test it locally as well but i don't have access to it, yet.

Template Validation

I've validated this template locally?

• [] YES
• NO

/claim #11218

Additional Details (leave it blank if not applicable)

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server

[GeorginaReeder]

Thanks for your contribution @zelosleone ! :)

[zelosleone]

Thanks for your contribution @zelosleone ! :)

Thank you, If there is anything I need to do for it to be merged, please let me know.

[algora-pbc]

👉 To complete your submission, sign up on Algora, link your Github account and submit the data for your PR.