High Confidence FortiSandbox JID Command Injection Attempt (CVE-2026-39808) - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects high-confidence OS command injection attempts against the FortiSandbox tracer-behavior jid parameter. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Regle STRICT unique pour CVE-2026-39808. Elle combine l endpoint vulnerable /fortisandbox/job-detail/tracer-behavior, la presence du parametre jid et des indices de commande shell. Le durcissement couvre les separateurs shell bruts, encodes et double-encodes, les chemins Linux courants, les substitutions de commande, les retours ligne, les espaces obfusques et les variantes ${IFS}. Une regle BROAD endpoint-seul reste ecartee car elle utilise la meme source de logs et ajoute du bruit sans phase observable differente. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: High Confidence FortiSandbox JID Command Injection Attempt (CVE-2026-39808) - STRICT
id: 511a0030-46c3-4218-ba2d-2d927b249e3f
status: experimental
description: |
Detects high-confidence OS command injection attempts against the FortiSandbox tracer-behavior jid parameter. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Regle STRICT unique pour CVE-2026-39808. Elle combine l endpoint vulnerable /fortisandbox/job-detail/tracer-behavior, la presence du parametre jid et des indices de commande shell. Le durcissement couvre les separateurs shell bruts, encodes et double-encodes, les chemins Linux courants, les substitutions de commande, les retours ligne, les espaces obfusques et les variantes ${IFS}. Une regle BROAD endpoint-seul reste ecartee car elle utilise la meme source de logs et ajoute du bruit sans phase observable differente. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
- https://fortiguard.fortinet.com/psirt/FG-IR-26-100
- https://nvd.nist.gov/vuln/detail/CVE-2026-39808
- https://github.com/samu-delucas/CVE-2026-39808
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-06-29
modified: 2026-06-29
related:
- id: 2a313108-a107-46df-bf49-501931d3e000
type: derived
- id: 1218eee5-8134-4c21-91f9-522b8cbd2f70
type: derived
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
- cve.2026-39808
logsource:
category: webserver
definition: >
Web, reverse proxy, WAF or FortiSandbox access logs with HTTP method, URI path and query string.
The rule expects the path and query to be available as cs-uri-stem and cs-uri-query, or mapped to
equivalent fields before Sigma conversion. Patterns cover raw, URL-encoded and double URL-encoded
shell syntax commonly preserved by web logging pipelines. If the proxy strips query strings or
logs only normalized URLs, this rule cannot observe the exploit payload.
detection:
selection_vulnerable_endpoint:
cs-method:
- 'GET'
- 'get'
cs-uri-stem|contains:
- '/fortisandbox/job-detail/tracer-behavior'
selection_jid_parameter:
cs-uri-query|contains:
- 'jid='
- 'JID='
selection_shell_separator:
cs-uri-query|contains:
- '|'
- '%7c'
- '%257c'
- ';'
- '%3b'
- '%253b'
- '`'
- '%60'
- '%2560'
- '$('
- '%24%28'
- '%2524%2528'
- '%0a'
- '%250a'
- '%0d'
- '%250d'
- '&&'
- '%26%26'
- '%2526%2526'
- '||'
- '%7c%7c'
- '%257c%257c'
- '>'
- '%3e'
- '%253e'
selection_command_indicator:
cs-uri-query|contains:
- '|id'
- '| id'
- '|+id'
- '|%20id'
- '|%09id'
- '%7cid'
- '%7c%20id'
- '%7c+id'
- '%7c%09id'
- '%257cid'
- ';id'
- '; id'
- ';+id'
- ';%20id'
- ';%09id'
- '%3bid'
- '%3b%20id'
- '%3b+id'
- '%253bid'
- '`id'
- '%60id'
- '$(id'
- '%24%28id'
- '%2524%2528id'
- '%0aid'
- '%0a%20id'
- '%0a+id'
- '%0a%09id'
- '%0did'
- '/bin/id'
- '/usr/bin/id'
- '%2fbin%2fid'
- '%2fusr%2fbin%2fid'
- 'whoami'
- 'uname'
- '/bin/sh'
- '/bin/bash'
- '/bin/dash'
- '/bin/ash'
- '%2fbin%2fsh'
- '%2fbin%2fbash'
- 'sh%20-c'
- 'sh+-c'
- 'sh%09-c'
- 'bash%20-c'
- 'bash+-c'
- 'bash%09-c'
- 'curl%20'
- 'curl+'
- 'curl%09'
- 'wget%20'
- 'wget+'
- 'wget%09'
- 'busybox'
- 'chmod%20'
- 'chmod+'
- 'chmod%09'
- 'touch%20'
- 'touch+'
- 'touch%09'
- 'nc%20'
- 'nc+'
- 'nc%09'
- 'ncat%20'
- 'ncat+'
- 'ncat%09'
- 'ping%20'
- 'ping+'
- 'ping%09'
- 'nslookup'
- 'python%20-c'
- 'python+-c'
- 'python%09-c'
- 'python3%20-c'
- 'python3+-c'
- 'python3%09-c'
- 'perl%20-e'
- 'perl+-e'
- 'php%20-r'
- 'php+-r'
- 'cat%20/etc/passwd'
- 'cat+/etc/passwd'
- 'cat%09/etc/passwd'
- '%2fetc%2fpasswd'
selection_obfuscated_command:
cs-uri-query|contains:
- '${IFS}id'
- '$IFSid'
- '%24%7bIFS%7did'
- '%24%7BIFS%7Did'
- '%2524%257bIFS%257did'
- 'id${IFS}'
- 'id%24%7bIFS%7d'
- 'sh${IFS}-c'
- 'sh%24%7bIFS%7d-c'
- 'bash${IFS}-c'
- 'bash%24%7bIFS%7d-c'
- 'curl${IFS}'
- 'curl%24%7bIFS%7d'
- 'wget${IFS}'
- 'wget%24%7bIFS%7d'
- 'cat${IFS}'
- 'cat%24%7bIFS%7d'
- 'nc${IFS}'
- 'nc%24%7bIFS%7d'
filter_main_known_scanner:
c-useragent|contains:
- 'nessus'
- 'qualys'
- 'nexpose'
- 'openvas'
- 'acunetix'
condition: selection_vulnerable_endpoint and selection_jid_parameter and selection_shell_separator and (selection_command_indicator or selection_obfuscated_command) and not filter_main_known_scanner
fields:
- c-ip
- x-forwarded-for
- Host
- cs-method
- cs-uri
- cs-uri-stem
- cs-uri-query
- c-useragent
- Referer
- sc-status
- cs-bytes
falsepositives:
- Authorized red team or penetration test activity against FortiSandbox
- Authorized vulnerability scanner using exploit checks against this endpoint
- Extremely unlikely legitimate integration passing shell separators, command names, or shell whitespace obfuscation in a jid value on this specific endpoint
level: high