Fortinet FortiSandbox OS Command Injection (CVE-2026-39808)

// Requires FortiSandbox syslog/CEF forwarded into a custom table (FortiSandboxEvent_CL) or web proxy logs
let ShellMeta = dynamic([";","|","&&","`","$(","%0a","%0d","../../","wget ","curl ","/bin/sh","/bin/bash","nc ","chmod +x"]);
union isfuzzy=true
  (CommonSecurityLog
  | where DeviceVendor =~ "Fortinet" and DeviceProduct =~ "FortiSandbox"
  | where RequestURL has_any ("/api", "/sys", "/cgi-bin") ),
  (W3CIISLog
  | where cs_uri_stem has_any ("/api", "/sys", "/cgi-bin") )
| extend DecodedUrl = url_decode(RequestURL)
| where DecodedUrl has_any (ShellMeta)
| project TimeGenerated, SourceIP, DeviceVendor, DeviceProduct, RequestURL, DecodedUrl, DeviceAction
| order by TimeGenerated desc

index=network_proxy OR index=firewall sourcetype=cef OR sourcetype=fortinet:fortisandbox
| eval decoded_url=urldecode(request_url)
| regex decoded_url="(;|\||&&|`|\$\(|%0a|%0d|/bin/(ba)?sh|wget\s|curl\s|nc\s|chmod\s\+x)"
| where match(decoded_url, "(?i)(/api|/sys|/cgi-bin)")
| table _time, src_ip, dest_ip, decoded_url, http_method, status
| sort -_time

network where event.dataset in ("fortinet.fortisandbox", "proxy.log") and
  url.path : ("*api*", "*sys*", "*cgi-bin*") and
  (url.original : "*;*" or url.original : "*|*" or url.original : "*&&*" or url.original : "*%60*" or url.original : "*wget*" or url.original : "*curl*" or url.original : "*/bin/sh*" or url.original : "*/bin/bash*")

SELECT DATEFORMAT(devicetime, 'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, destinationip, URL, "Log Source"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Fortinet%'
  AND (URL ILIKE '%;%' OR URL ILIKE '%|%' OR URL ILIKE '%&&%' OR URL ILIKE '%wget%' OR URL ILIKE '%curl%' OR URL ILIKE '%/bin/sh%' OR URL ILIKE '%/bin/bash%')
  AND (URL ILIKE '%/api%' OR URL ILIKE '%/sys%' OR URL ILIKE '%/cgi-bin%')
LAST 24 HOURS

_sourceCategory=*fortinet* OR _sourceCategory=*proxy*
| parse regex "(?<url>\S*(api|sys|cgi-bin)\S*)"
| where url matches "*;*" or url matches "*|*" or url matches "*&&*" or url matches "*wget*" or url matches "*curl*" or url matches "*/bin/sh*" or url matches "*/bin/bash*"
| count by url, _sourceHost
| sort -_count

rule fortisandbox_cmd_injection_cve_2026_39808 {
  meta:
    author = "df00tech"
    description = "Detects HTTP requests to FortiSandbox with OS command injection patterns (CVE-2026-39808)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /.*(api|sys|cgi-bin).*/
    $e.target.url = /.*(;|\||&&|wget|curl|\/bin\/sh|\/bin\/bash).*/
    $e.principal.hostname = /.*[Ff]orti[Ss]andbox.*/ or $e.target.hostname = /.*[Ff]orti[Ss]andbox.*/
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| in(field="ParentBaseFileName", values=["fsav_httpd", "httpsd", "forticron", "fsw_agent"], ignoreCase=true)
| in(field="FileName", values=["sh", "bash", "wget", "curl", "nc", "chmod", "python", "perl"], ignoreCase=true)
| table(["@timestamp", ComputerName, ParentBaseFileName, FileName, CommandLine])
| sort("@timestamp", order=desc)