FortiSandbox XSS Vulnerability Let Attackers Run Arbitrary Commands

Fortinet has disclosed a high-severity cross-site scripting (XSS) vulnerability in its FortiSandbox platform, tracked as CVE-2025-52436 (FG-IR-25-093), that enables unauthenticated attackers to execute arbitrary commands on affected systems.

Dubbed an “Improper Neutralization of Input During Web Page Generation” issue (CWE-79), the flaw resides in the graphical user interface (GUI) component and scores a 7.9.

At its core, this reflected XSS vulnerability arises from inadequate input sanitization in web page generation. An attacker crafts malicious requests, typically via the browser’s back button or manipulated parameters, that inject executable JavaScript into the GUI.

Once a victim (like an admin) interacts with the tainted page, the script triggers, escalating to remote code execution (RCE). This grants full command-line access, potentially leading to data exfiltration, lateral movement, or sandbox evasion in malware analysis environments.

Affected Versions and Patches

FortiSandbox PaaS deployments bear the brunt:

Version Series	Affected Builds	Recommended Action
5.0	5.0.0 to 5.0.1	Upgrade to 5.0.2+
4.4	4.4.0 to 4.4.7	Upgrade to 4.4.8+
4.2	All versions	Migrate to fixed release
4.0	All versions	Migrate to fixed release

Patches landed in PaaS versions 4.4.8 and 5.0.5. Fortinet urges immediate upgrades, emphasizing exposure mitigation via network segmentation and GUI access restrictions until patched.

Credit goes to Jaguar Perlas of Fortinet’s Burnaby Infosec team for internal discovery. This incident underscores persistent XSS risks in enterprise tools, even sandboxes meant to isolate threats.

Organizations scanning malware or handling sensitive intel should prioritize patching unpatched systems invite command-and-control pivots. Fortinet reports no known exploitation, but the unauthenticated vector demands vigilance.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post FortiSandbox XSS Vulnerability Let Attackers Run Arbitrary Commands appeared first on Cyber Security News.