Fortinet: FortiSandbox XSS Vulnerability Let Attackers Run Arbitrary Commands

Fortinet Patches High-Severity XSS Flaw in FortiSandbox, Risking Remote Code Execution

Fortinet has disclosed a high-severity cross-site scripting (XSS) vulnerability, CVE-2025-52436 (FG-IR-25-093), affecting its FortiSandbox platform. The flaw, classified as an "Improper Neutralization of Input During Web Page Generation" (CWE-79), allows unauthenticated attackers to execute arbitrary commands on vulnerable systems.

The reflected XSS vulnerability stems from insufficient input sanitization in the GUI component. Attackers can craft malicious requests via manipulated parameters or the browser’s back button to inject malicious JavaScript. If an admin interacts with the compromised page, the script triggers, enabling remote code execution (RCE). This could lead to data exfiltration, lateral movement, or sandbox evasion in malware analysis environments.

Affected Versions & Patches

The vulnerability impacts FortiSandbox PaaS deployments across multiple versions:

• 5.0.0–5.0.1 → Upgrade to 5.0.2+
• 4.4.0–4.4.7 → Upgrade to 4.4.8+
• 4.2 & 4.0 → Migrate to a fixed release

Patches were released in FortiSandbox PaaS 4.4.8 and 5.0.5. Fortinet recommends immediate upgrades, along with network segmentation and GUI access restrictions as interim mitigations.

The flaw was discovered internally by Jaguar Perlas of Fortinet’s Burnaby Infosec team. While no active exploitation has been reported, the unauthenticated attack vector heightens risk, particularly for organizations handling sensitive malware analysis or threat intelligence. The incident highlights persistent XSS risks in enterprise security tools, even in isolated sandbox environments.

Source: https://cybersecuritynews.com/fortisandbox-xss-vulnerability/

Fortinet cybersecurity rating report: https://www.rankiteo.com/company/fortinet

"id": "FOR1770745922",
"linkid": "fortinet",
"type": "Vulnerability",
"date": "1/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Cybersecurity',
                        'name': 'Fortinet FortiSandbox',
                        'type': 'Security Platform'}],
 'attack_vector': 'Unauthenticated reflected XSS via manipulated parameters or '
                  'browser’s back button',
 'data_breach': {'data_exfiltration': 'Potential'},
 'description': 'Fortinet has disclosed a high-severity cross-site scripting '
                '(XSS) vulnerability, CVE-2025-52436 (FG-IR-25-093), affecting '
                'its FortiSandbox platform. The flaw allows unauthenticated '
                'attackers to execute arbitrary commands on vulnerable systems '
                'via reflected XSS due to improper input sanitization in the '
                'GUI component. This could lead to remote code execution '
                '(RCE), data exfiltration, lateral movement, or sandbox '
                'evasion in malware analysis environments.',
 'impact': {'data_compromised': 'Potential data exfiltration',
            'operational_impact': 'Remote code execution (RCE), lateral '
                                  'movement, sandbox evasion',
            'systems_affected': 'FortiSandbox PaaS deployments'},
 'lessons_learned': 'Highlights persistent XSS risks in enterprise security '
                    'tools, even in isolated sandbox environments.',
 'post_incident_analysis': {'corrective_actions': 'Patches released, network '
                                                  'segmentation, GUI access '
                                                  'restrictions',
                            'root_causes': 'Insufficient input sanitization in '
                                           'the GUI component'},
 'recommendations': 'Immediate upgrades to patched versions (FortiSandbox PaaS '
                    '4.4.8+ or 5.0.5+), network segmentation, and GUI access '
                    'restrictions.',
 'references': [{'source': 'Fortinet Advisory'}],
 'response': {'containment_measures': 'Network segmentation, GUI access '
                                      'restrictions',
              'network_segmentation': 'Recommended as interim mitigation',
              'remediation_measures': 'Patches released (FortiSandbox PaaS '
                                      '4.4.8 and 5.0.5), immediate upgrades '
                                      'recommended'},
 'title': 'Fortinet Patches High-Severity XSS Flaw in FortiSandbox, Risking '
          'Remote Code Execution',
 'type': 'Cross-Site Scripting (XSS)',
 'vulnerability_exploited': 'CVE-2025-52436 (Improper Neutralization of Input '
                            'During Web Page Generation - CWE-79)'}