{"uuid": "de1c2c8d-cde5-47be-980d-db6596fca537", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39952", "type": "exploited", "source": "https://t.me/hacking_Attack/91461", "content": "Black Hat Ethical Hacking\nFortinet\u2019s FortiNAC Network Access Control Suite Hacked: Critical Vulnerability Discovered\n\nFortinet\u2019s FortiNAC Network Access Control Suite Hacked: Critical Vulnerability DiscoveredPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Critical vulnerability in Fortinet\u2019s FortiNAC network access control suite exposedFortinet\u2019s FortiNAC network access control suite has been hit with a critical security vulnerability (CVE-2022-39952), which has recently been exploited. The security issue was first disclosed on February 16 by Fortinet, and its severity score was calculated at 9.8. The company has warned that it could enable an unauthenticated attacker to write arbitrary files on the system and execute remote code with the highest privileges.\n\nThe vulnerability has been detected in FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, and all versions on the 8.8, 8.7, 8.6, 8.5, and 8.3 branches. To mitigate the risk, organizations that use these versions have been urged to apply the available security updates.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses How the PoC exploit works and the implications for FortiNAC usersRecently, security researchers at Horizon3 cybersecurity company have released a technical post revealing how the vulnerability can be exploited. They have also provided proof-of-concept (PoC) exploit code on the company\u2019s GitHub repository. The researchers explain that the exploit involves writing a cron job to /etc/cron.d/ that triggers every minute to initiate a root reverse shell to the attacker, giving them remote code execution capabilities.\n\nThe analysts at Horizon3 discovered that the fix for CVE-2022-39952 removed \u2018keyUpload.jsp,\u2019 an endpoint that parses requests for a \u2018key\u2019 parameter, writes it on a config file, and then executes a bash script, \u2018configApplianceXml.\u2019 The bash script executes the \u2018unzip\u2019 command on the newly written file, allowing any arbitrary file to be written. Hence, an attacker can create a ZIP archive that contains the payload, specifying where it must be extracted, and then send it to the vulnerable endpoint using the key parameter. The reverse shell should be ready within a minute.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Security/8/script.png The executed bash script (Horizon3)\n\n \nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Security/8/poc.png Executing the\u00a0PoC\u00a0exploit (Horizon3)\nTrending: Exploiting LFI Vulnerabilities Trending: Offensive Security Tool: TerminatorZ Recommended actions for FortiNAC administrators to protect against the vulnerability.Fortinet administrators are strongly advised to upgrade immediately to a version of the product that is not affected by the CVE-2022-39952 vulnerability. Specifically, FortiNAC 9.4.1 or later, 9.2.6 or above, 9.1.8 or newer, and 7.2.0 or later. The code from Horizon3 can also help defenders build appropriate protection against exploitation attempts on corporate networks.\nTrending: Zero-Day Threat Alert: Hackers Target iPhones, iPads, and Macs Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Full post https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-c[...]", "creation_timestamp": "2026-09-05T01:00:15.459484Z"}