CISA KEV Alert: Remediate Active Exchange SSRF (CVE-2024-26234) and Fortinet RCE (CVE-2023-48788)

---
title: Potential Exchange Server Web Shell via SSRF Exploitation
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects suspicious process execution patterns often associated with web shell activity following Exchange exploitation. Looks for cmd.exe or powershell.exe spawned by the IIS worker process.
references:
  - https://msrc.microsoft.com/advisory
author: Security Arsenal
date: 2024/04/17
tags:
  - attack.initial_access
  - attack.web_shell
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  filter:
    User|contains: 'IIS APPPOOL'
    # Standard IIS operations sometimes run system commands, but rare for high-privilege shells
    CommandLine|contains:
      - 'appcmd'
      - 'bypass'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative scripts run via IIS
level: high
---
title: Fortinet FortiClientEMS SQL Injection Exploitation Activity
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects potential exploitation of CVE-2023-48788 by looking for shell execution spawned by the FortiClientEMS Java service.
references:
  - https://www.fortiguard.com/psirt/FG-IR-23-260
author: Security Arsenal
date: 2024/04/17
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2023.48788
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: '\FCTEMS\'
    ParentImage|endswith: '\java.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Administrative debugging on the EMS server
level: critical

// Hunt for Exchange suspicious process spawns
DeviceProcessEvents  
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "w3wp.exe"
| where ProcessFileName in ("cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FolderPath
| extend RiskScore = iff(InitiatingProcessCommandLine contains "Microsoft Exchange", 1, 0)
| order by Timestamp desc

// Hunt for Fortinet EMS SQLi/RCE indicators
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFolderPath contains "FCTEMS"
| where ProcessFileName in ("cmd.exe", "powershell.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine
| order by Timestamp desc

-- Hunt for Exchange worker processes spawning shells
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Parent.Name =~ "w3wp.exe"
  AND Name IN ("cmd.exe", "powershell.exe", "pwsh.exe")
  AND Exe NOT =~ "Windows\\System32\\inetsrv"

-- Hunt for Fortinet EMS Service (Java) spawning shells
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Parent.Name =~ "java.exe"
  AND Name IN ("cmd.exe", "powershell.exe")
  AND Parent.Exe =~ "FCTEMS"

<#
.SYNOPSIS
    Checks Exchange Server version against vulnerable builds for CVE-2024-26234.
.DESCRIPTION
    This script queries the local Exchange Server for the product version and compares
    it against the security update table provided by Microsoft.
#>

function Test-ExchangeVulnerability {
    $ExSetupPath = "$env:ExchangeInstallPath\bin\ExSetup.exe"
    if (-not (Test-Path $ExSetupPath)) {
        Write-Host "[-] Exchange Setup binary not found. Is this an Exchange Server?"
        return
    }

    $VersionInfo = (Get-Item $ExSetupPath).VersionInfo.FileVersion
    Write-Host "[*] Current Exchange Version: $VersionInfo"

    # Minimum secure versions based on MSRC advisory for CVE-2024-26234
    $SecureVersions = @{
        "2013" = "15.00.1497.042"
        "2016" = "15.01.2507.025"
        "2019" = "15.02.1118.029"
    }

    # Determine Major Version
    if ($VersionInfo -like "15.00.*") { $CurrentMajor = "2013" }
    elseif ($VersionInfo -like "15.01.*") { $CurrentMajor = "2016" }
    elseif ($VersionInfo -like "15.02.*") { $CurrentMajor = "2019" }
    else {
        Write-Host "[-] Unsupported Exchange Version detected."
        return
    }

    if ([version]$VersionInfo -lt [version]$SecureVersions[$CurrentMajor]) {
        Write-Host "[!] VULNERABLE: Build is older than the secure baseline ($($SecureVersions[$CurrentMajor]))."
        Write-Host "[!] Action: Install the latest Cumulative Update immediately."
    } else {
        Write-Host "[+] SECURE: Build meets or exceeds the security patch baseline."
    }
}

Test-ExchangeVulnerability