{"uuid": "ce32715d-59e4-428f-9771-d24dd436889e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39952", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinac_keyupload_file_write.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Gwendal Gu\\u00e9gniaud\", \"Zach Hanley\", \"jheysel-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module uploads a payload to the /tmp directory in addition to a cron job\\n          to /etc/cron.d which executes the payload in the context of the root user.\\n\\n          The core vulnerability is an arbitrary file write issue in /configWizard/keyUpload.jsp which\\n          is accessible remotely and without authentication. When you send the vulnerable\\n          endpoint a ZIP file, it will extract an attacker controlled file to a directory\\n          of the attackers choice on the target system.\\n\\n          This issue is exploitable on the following versions of FortiNAC:\\n\\n          FortiNAC version 9.4 prior to 9.4.1\\n          FortiNAC version 9.2 prior to 9.2.6\\n          FortiNAC version 9.1 prior to 9.1.8\\n          FortiNAC 8.8 all versions\\n          FortiNAC 8.7 all versions\\n          FortiNAC 8.6 all versions\\n          FortiNAC 8.5 all versions\\n          FortiNAC 8.3 all versions\", \"disclosure_date\": \"2023-02-16\", \"fullname\": \"exploit/linux/http/fortinac_keyupload_file_write\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Fortinet FortiNAC keyUpload.jsp arbitrary file write\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/fortinac_keyupload_file_write.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/fortinac_keyupload_file_write\", \"references\": [\"URL-https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/\", \"URL-https://www.fortiguard.com/psirt/FG-IR-22-300\", \"URL-https://github.com/horizon3ai/CVE-2022-39952\", \"URL-https://attackerkb.com/topics/9BvxYuiHYJ/cve-2022-39952\", \"CVE-2022-39952\"], \"rport\": 8443, \"session_types\": false, \"targets\": [\"CMD\", \"Linux x86\", \"Linux x64\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:34.143792Z"}