The vulnerability stems from a dangerous path traversal weakness within the FortiSIEM gRPC service, which listens on TCP port 27918. According to technical analysis published by cybersecurity firm Horizon3.ai, the core issue lies in the way the service handles incoming connections and processes untrusted metadata. Specifically, the gRPC QueryResultReq handler fails to implement proper path validation before processing parameters supplied directly by users.
Security analysts discovered that an unauthenticated attacker can connect directly to the exposed gRPC service and exploit the lack of input sanitization. By carefully crafting network packets containing both directory traversal sequences and specific injection techniques within the HTTP/2 and HPACK encoding layers of the gRPC protocol, malicious actors can manipulate file paths. This manipulation ultimately turns an arbitrary-file-write primitive into full remote code execution on vulnerable systems, allowing unauthorized users to execute code or administrative commands.
The technical mechanics of the flaw reveal a chain of vulnerabilities that combine to achieve remote code execution. The problem originates from unsafe path construction inside a function known as SendQueryResult(). This function takes a user-supplied "query-id" parameter and passes it directly into the application logic without enforcing sufficient validation checks.
While the inclusion of directory traversal sequences—such as standard dot-dot-slash patterns—allows an attacker to escape the intended directory and navigate the file system to a location of their choice, a built-in application constraint initially appears to limit the damage. Specifically, the FortiSIEM program automatically appends a predetermined file name suffix to the path, structured as "result–0-0-.dat," where the identifier component acts as a server-controlled counter value. Because of this automated naming convention, an attacker can choose the target directory for a file write, but standard traversal alone would not allow them to dictate the exact file name or target an existing system file directly.
However, attackers can bypass this limitation by exploiting a secondary weakness involving null-byte injection. By embedding a null byte within the "query-id" parameter, malicious actors can trick the underlying operating system into treating the null byte as a string terminator. When the path is subsequently passed to the system’s file-opening functions, everything appearing after the null byte is effectively discarded and ignored by the system.
This behavior allows an attacker to construct a specialized "query-id" value featuring a null byte placed immediately after a targeted file path of their choosing. For instance, an attacker could supply a string directed at an existing system file, such as a shell script responsible for routine maintenance tasks. In FortiSIEM environments, researchers identified that a specific shell script named redishb.sh, located in the charting directory, performs health checks on the Redis service and is executed automatically every sixty seconds by a system cron job.
By leveraging the null-byte injection technique, the resulting file write lands precisely on the exact file path that preceded the null byte, bypassing the automatically appended suffix entirely. Because the write operation targets an existing file in place, it preserves the original file owner and permissions, effectively modifying system scripts without raising immediate operational suspicions. Researchers also noted that alternative variants of the attack can utilize multiple requests to successfully create entirely brand-new files with exact names and contents determined by the attacker.
Fortinet released software updates addressing this critical security flaw last week, urging administrators to update their installations immediately to protect against active exploitation attempts. The release of the public proof-of-concept exploit by Horizon3.ai significantly increases the urgency for organizations running vulnerable versions of FortiSIEM to apply the vendor-supplied patches, as threat actors frequently operationalize public exploit code shortly after its release. Security teams are encouraged to review Fortinet’s official advisory, verify their software versions, and ensure that network exposure to the gRPC service on TCP port 27918 is appropriately restricted to trusted administrative segments.
