CVE-2025-24472 — Fortinet FortiOS / FortiProxy Authentication Bypass
Overview
CVE-2025-24472 is an authentication bypass vulnerability in Fortinet FortiOS and
FortiProxy. An unauthenticated attacker can craft specially formed CSF (Central
Security Fabric) proxy requests to gain super-admin privileges on affected
devices. The flaw carries a CVSS score of 8.1 and is known to be actively
exploited by ransomware groups including SuperBlack (Mora_001).
Technical Details
- CWE: 288 — Authentication Bypass Using an Alternate Path or Channel
- Root Cause: Insufficient validation of CSF proxy requests allows an
attacker to impersonate a trusted fabric device without proper credentials.
- Attack Vector: Network-based, unauthenticated
- Impact: Complete compromise of confidentiality, integrity, and
availability (super-admin access).
Affected Versions
| Product | Affected Versions |
|---|
| FortiOS | 7.0.0 – 7.0.16 |
| FortiProxy | 7.2.0 – 7.2.12, 7.0.0 – 7.0.19 |
Prerequisites for Exploitation
- Attacker knows the target device serial number.
- Security Fabric feature is enabled on the target.
Exploitation
The attacker sends a crafted HTTP request to the target's CSF proxy endpoint.
By manipulating the Forwarded-For or Authorization headers and embedding the
target serial number, the request is processed as originating from a trusted
fabric member. The device then grants super-admin privileges without requiring
valid credentials.
Reproduction Steps
- Identify a target running an affected FortiOS or FortiProxy version.
- Obtain or enumerate the device serial number.
- Send a crafted POST request to the CSF proxy endpoint with the serial
number embedded in the request headers.
- The target responds with a session token granting super-admin privileges.
- Use the token to authenticate and access the device management interface.
Proof of Concept
See exploit.py for a complete PoC script.
Mitigation
- Upgrade to FortiOS 7.0.17+ or FortiProxy 7.2.13+ / 7.0.20+.
- Restrict access to the management interface to trusted IPs only.
- Disable Security Fabric if not required.
- Monitor logs for anomalous CSF proxy requests.
References
razureink/cve-2025-24472-fortinet_authbypass_reproduction
