Unauthenticated Arbitrary File Upload in FortiLogger 4.4.2.2

This repository contains a single Metasploit module targeting FortiLogger for Windows (versions < 5.2.0) and exploits CVE-2021-3378. The exploit leverages an unauthenticated arbitrary file upload vulnerability via the '/Config/SaveUploadedHotspotLogoFile' HTTP endpoint. The module generates a malicious ASP payload (converted from an EXE), uploads it as an image file, and then triggers its execution by accessing '/Assets/temp/hotspot/img/logohotspot.asp'. The exploit provides remote code execution on the target system. The module also includes a check routine that queries '/shared/GetProductInfo' to determine the FortiLogger version. The code is written in Ruby and is structured as a standard Metasploit exploit module, making it easy to use within the Metasploit framework.

This repository contains a Metasploit module (fortilogger_arbitrary_fileupload.rb) that exploits CVE-2021-3378, an unauthenticated arbitrary file upload vulnerability in FortiLogger version 4.4.2.2. The exploit works by sending a crafted POST request to the /Config/SaveUploadedHotspotLogoFile endpoint, uploading a malicious ASP payload (such as a reverse shell) to the server. The payload is then executed by accessing it via the /Assets/temp/hotspot/img/logohotspot.asp endpoint, resulting in remote code execution. The module includes a check method to verify the target version via the /shared/GetProductInfo endpoint. The exploit is weaponized, allowing customizable payloads through the Metasploit framework, and targets Windows installations of FortiLogger. The repository consists of a README.md with usage details and the main exploit Ruby file.