Webserver Rule: Fortinet WAF CVE-2021-22123 Exploitation Attempt via POST to SAML Endpoint

title: "Webserver Rule: Fortinet WAF CVE-2021-22123 Exploitation Attempt via POST to SAML Endpoint"
id: 83e89ac3-a930-46a8-be15-976f086cf406
status: test
description: This rule identifies HTTP POST requests to a specific Fortinet WAF API path that includes a remoteserver.saml-related endpoint query pattern. It further narrows matches by requiring the request Referer not to contain the expected SAML-related path fragment and not to be null, indicating likely crafted traffic rather than normal browsing. The detection relies on webserver request telemetry fields including method, URI query, and Referer.
references:
  - https://www.rapid7.com/blog/post/2021/08/17/fortinet-fortiweb-os-command-injection
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-22123/web_cve_2021_22123_fortinet_exploit.yml
author: Bhabesh Raj, Florian Roth, Huntrule Team
date: 2021-08-19
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-22123
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: /api/v2.0/user/remoteserver.saml
    cs-method: POST
  filter1:
    cs-referer|contains: /root/user/remote-user/saml-user/
  filter2:
    cs-referer: null
  condition: selection and not filter1 and not filter2
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: f425637f-891c-4191-a6c4-3bb1b70513b4
    type: derived