Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/razureink/cve-2025-24472-fortinet_authbypass_reproduction
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration TestingAuthenticationRed Teaming
GitHubrazureink/cve-2025-24472-fortinet_authbypass_reproduction

cve-2025-24472-fortinet_authbypass_reproduction

CVE Reproduction: cve-2025-24472-fortinet_authbypass_reproduction

View Repository
11 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-24472 — Fortinet FortiOS / FortiProxy Authentication Bypass

Overview

CVE-2025-24472 is an authentication bypass vulnerability in Fortinet FortiOS and FortiProxy. An unauthenticated attacker can craft specially formed CSF (Central Security Fabric) proxy requests to gain super-admin privileges on affected devices. The flaw carries a CVSS score of 8.1 and is known to be actively exploited by ransomware groups including SuperBlack (Mora_001).

Technical Details

  • CWE: 288 — Authentication Bypass Using an Alternate Path or Channel
  • Root Cause: Insufficient validation of CSF proxy requests allows an attacker to impersonate a trusted fabric device without proper credentials.
  • Attack Vector: Network-based, unauthenticated
  • Impact: Complete compromise of confidentiality, integrity, and availability (super-admin access).

Affected Versions

ProductAffected Versions
FortiOS7.0.0 – 7.0.16
FortiProxy7.2.0 – 7.2.12, 7.0.0 – 7.0.19

Prerequisites for Exploitation

  1. Attacker knows the target device serial number.
  2. Security Fabric feature is enabled on the target.

Exploitation

The attacker sends a crafted HTTP request to the target's CSF proxy endpoint. By manipulating the Forwarded-For or Authorization headers and embedding the target serial number, the request is processed as originating from a trusted fabric member. The device then grants super-admin privileges without requiring valid credentials.

Reproduction Steps

  1. Identify a target running an affected FortiOS or FortiProxy version.
  2. Obtain or enumerate the device serial number.
  3. Send a crafted POST request to the CSF proxy endpoint with the serial number embedded in the request headers.
  4. The target responds with a session token granting super-admin privileges.
  5. Use the token to authenticate and access the device management interface.

Proof of Concept

See exploit.py for a complete PoC script.

Mitigation

  • Upgrade to FortiOS 7.0.17+ or FortiProxy 7.2.13+ / 7.0.20+.
  • Restrict access to the management interface to trusted IPs only.
  • Disable Security Fabric if not required.
  • Monitor logs for anomalous CSF proxy requests.

References

  • https://www.fortiguard.com/psirt/FG-IR-25-005
  • https://attack.mitre.org/techniques/T1190/
  • https://nvd.nist.gov/vuln/detail/CVE-2025-24472
Download Tool