Data Manipulation Vulnerability in Fortinet FortiSIEM

The German Federal Office for Information Security (BSI) has released a security advisory regarding a vulnerability in Fortinet FortiSIEM. This flaw allows a remote, authenticated attacker to perform unauthorized data manipulation within the FortiSIEM environment. By leveraging the identified vulnerability, documented as CVE-2024-23108, an attacker who has already achieved authentication to the system can compromise the integrity of security logs, configuration data, or other sensitive information handled by the SIEM. Because this flaw requires an existing authentication context, defenders should prioritize the review of access controls and monitor for suspicious administrative or data-altering actions performed by authenticated service accounts or user sessions.

Impact

The successful exploitation of this vulnerability results in the degradation of data integrity within FortiSIEM. This could allow an attacker to obfuscate malicious activity by altering security logs, bypassing detection rules, or modifying operational settings. Organizations relying on FortiSIEM for centralized visibility and incident response are particularly at risk, as the integrity of the SIEM platform is foundational to effective security operations.

Recommendation

Prioritize the identification and application of firmware updates provided by Fortinet for affected FortiSIEM installations. Since the attack requires authentication, monitor for anomalous activity in administrative sessions, such as unexpected API calls or file modification events, for all users who have access to the SIEM's backend or data management functions.