Loading vulnerability…
CVE-2023-42791 is a relative path traversal vulnerability in Fortinet FortiManager and FortiAnalyzer. A remote attacker with low privileges can send crafted HTTP requests that abuse insufficient path restriction during file handling, enabling writes outside the intended directory structure. In the documented exploitation path, the flaw is reachable through configuration import-related upload functionality and can be used to place attacker-controlled files on the underlying Linux filesystem. This behavior can then be leveraged to execute unauthorized code or commands on the appliance.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains two main Python scripts for exploiting vulnerabilities in FortiManager and related Fortinet products: 1. rce.py: This script exploits insufficient authorization and unrestricted file upload vulnerabilities (CVE-2023-42791, CVE-2024-23666) to achieve remote code execution or privilege escalation. It allows an attacker with valid (even low-privileged) credentials to upload a malicious shared library and supporting files to the target device. The exploit can either spawn a reverse shell (using a Python one-liner) or create a new administrator account by uploading crafted files and triggering their execution via manipulation of /etc/ld.so.preload. The script interacts with the FortiManager's web API endpoints over HTTPS. 2. ManagerGate.py: This script provides a way to connect to managed FortiGate SSH services via the FortiManager, leveraging credentials and device information. It uses asynchronous Python and websockets to interact with the FortiManager's internal APIs, allowing the attacker to open a shell on managed FortiGate devices (SSH password for the FortiGate is still required, but may be retrievable from FortiManager backups). The repository is well-structured, with clear separation between the two exploitation techniques. The README provides detailed usage instructions, affected versions, and references. The main attack vector is network-based, targeting FortiManager's web interface. Several fingerprintable endpoints are present, including specific API paths and file system locations on the target device. The exploit is operational, providing working payloads and automation for both reverse shell and privilege escalation scenarios.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.