Add exploit module for Fortinet FortiWeb (CVE-2025-64446 + CVE-2025-58034) #20717
+608
−1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…e parent dies it tears down our payload child process
Contributor
Author
|
Regarding the Fetch payloads not working (at least on
And as we cannot make the bin executable, the payload fails. Looking at the dmsg we see a clue:
and if we open the kernel in IDA we see this is coming from the kernel (so no AppArmour, or any other way we can try to disable) 
Given the unix payloads work (I successfully tested |
Contributor
Author
|
Changing from Draft to Open, as I have resolved/investigated the two blockers. |
|
this exploit is so sneaky it must’ve learned from me 😂🔧 |
Contributor
|
A dumb trick to bypass the lack of |
jvoisin
reviewed
Nov 22, 2025
| * FortiWeb `7.0.0` through `7.0.11` (Patched in `7.0.12` and above) | ||
|
|
||
| The command injection `CVE-2025-58034` affects the following versions (Note the `7.6` and `7.4` branches are very | ||
| slightly different when compared to the patch versions for `CVE-2025-64446`: |
Contributor
Author
Thanks @jvoisin that's a good suggestion, unfortunately it does not work as expected. If I experiment with the following: We get an "Permission denied" after trying to execute the bin. Inspecting dmesg I can see this:
And looking at the kernel in IDA, I see this is coming from the Linux Integrity Measurement Architecture (IMA) appraisal feature. We can inspect the kernel command line and see and I can see the IMA attributes on the legit file, for example: I don't know enough about IMA to give any more context. quick follow-on: Manually trying to add a new attribute via either |
Contributor
|
Wow, that's pretty neat! |
Contributor
|
I cannot seem to get a session? console output |
|
Seems to be giving false positive in my case. Says it has successfully created admin account, but manually entering the credentials results in |
…tested against 8.0.1 and 7.4.8
…oad in a new session, so we use a python stub to essentially call setsid. This has been tested to work on both 8.0.1 and 7.4.8. Teh payload cmd/unix/reverse_python isnot working as it previously was, so I am removing from the list of confirmed paylaods. The other two, cmd/unix/reverse_bash and cmd/unix/reverse_openssl work fine on both versions
Contributor
Author
|
Hi @SafalKarkey , I have tested on I also improved the check routine in commit 8a054b7 which might help avoid false positives for the auth bypass. |
Contributor
Author
|
Hi @bwatters-r7 , that's unexpected. I think first steps would be to confirm the network setup (I saw in #6446. you had some network issues)
|
Contributor
|
@sfewer-r7 you're right.... ish? When I could not talk to the admin console from outside the subnet on the last PR, I projected competence on the developers because a firewall preventing anything from accessing the admin interface from outside the subnet is a pretty good idea, honestly. I just dropped a second interface on my msf host that was in the same subnet and it worked, so I assumed the device itself had a firewall to protect itself during setup. For the callback, it made no sense to prevent it from talking to anything outside its own subnet, so I assumed there was an issue with the exploit, since I could talk to it just fine. After getting the callback on the interface in the same subnet without issue, I thought for a second and realized I followed the instructions without thinking, and the instructions assigned an IP, but no gateway.... No wonder it could not talk out of the local subnet. 🤣 |
Contributor
|
@SafalKarkey did this help? I'd love to get this landed today before the Americans disappear for turkey, naps, and football. |
Contributor
Author
|
brilliant, thanks @bwatters-r7! |
bwatters-r7
approved these changes
Nov 25, 2025
Contributor
Release NotesAdds a new module chaining FortiWeb vulnerabilities CVE-20205-64446 and CVE-2025-58034 to gain unauthenticated code execution on a FortiWeb server. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
This pull request add in a new exploit module targeting Fortinet FortiWeb via CVE-2025-64446 + CVE-2025-58034.
CVE-2025-64446 is an authentication bypass that lets a unauthenticated attacker create a new admin account on the target. For a technical analysis see the watchTowr blog.
CVE-2025-58034 is an authenticated command injection, that allows for root OS command execution. For a technical analysis see our Rapid7 Analysis.
Chained together we get unauthenticated RCE.
To-Do
I have opened this pull request as a draft while several outstanding issue are investigated.
The fetch payloads don't work as any dropped binary cannot be made executable and therefor fails to run. I have not yet investigated the cause of this.
The session handler on the framework side has been observed to kill the session prematurely (an EOFError for unknown reasons in
Msf::Sessions::CommandShell#shell_read). I could prevent this by clobbering the modulesself.clientHttpClient instance which is modified by the WebSocket mixin. I don't understand why this would impact the session handler though. Using a manually created netcat handler seems to avoids the issue (the session stays alive as expected), so I don't think the issue is on the target side.nohup.Examples
Example 1 (CVE-2025-64446 + CVE-2025-58034)
In this example,
CVE-2025-64446is used to create a new admin account and thenCVE-2025-58034is usedto execute a payload. This chain gives unauthenticated RCE and is the default operation of the exploit module.
Example 2 (CVE-2025-58034)
In this example, the attacker has existing admin credentials, so only
CVE-2025-58034is usedto execute a payload.