Product:
FortiSandbox
Summary
A Server-Side Request Forgery (SSRF) vulnerability exists in Fortinet FortiSandbox versions 5.0.0 through 5.0.4, as well as all versions of FortiSandbox 4.4, 4.2, and 4.0. This vulnerability may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 3.8 | CVE-2025-67685 |
Exploitation
To exploit this vulnerability, an attacker must be authenticated and can send specially crafted HTTP requests to the FortiSandbox. By doing so, the attacker can manipulate internal requests, potentially gaining access to sensitive internal resources that should not be exposed.
Affected Products
- FortiSandbox 5.0.0 through 5.0.4
- FortiSandbox 4.4 all versions
- FortiSandbox 4.2 all versions
- FortiSandbox 4.0 all versions
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of FortiSandbox that addresses this issue. Additionally, restricting access to the FortiSandbox interface and monitoring for unusual activity can help reduce the risk of exploitation.