Critical Pre-Auth RCE Exploit Released for Fortinet FortiWeb: Patch Immediately

Proof-of-concept (PoC) exploits for a critical SQL injection (SQLi) vulnerability in Fortinet FortiWeb have been publicly released, enabling attackers to execute remote code without authentication. The flaw, tracked as CVE-2025-25257, affects multiple versions of FortiWeb and has a CVSS score of 9.6, indicating high severity. Administrators are urged to apply patches immediately or implement mitigations to prevent exploitation.

Summary for Decision Makers

The vulnerability allows unauthenticated attackers to execute arbitrary code on vulnerable FortiWeb servers by sending crafted HTTP requests. Exploits leverage SQL injection to write malicious files to the server, enabling full system compromise. Affected versions include FortiWeb 7.6.0–7.6.3 and 7.4.0–7.4.7, with patches available in versions 7.6.4+ and 7.4.8+.

CVE: CVE-2025-25257 (CVSS 9.6)
Affected Products: FortiWeb 7.6.0–7.6.3, 7.4.0–7.4.7
Root Cause: Unsanitized input in the get_fabric_user_by_token function
Exploit Vector: HTTP requests to /api/fabric/device/status or /api/v[0-9]/fabric/widget
Mitigation: Patch to FortiWeb 7.6.4+/7.4.8+ or disable HTTP/HTTPS admin interfaces

Technical Analysis

The vulnerability stems from improper input sanitization in FortiWeb’s API endpoints. Attackers can inject malicious SQL queries through the Authorization header, bypassing authentication checks. The PoC demonstrates how to use MySQL’s INTO OUTFILE to write a Python .pth file to the server, achieving RCE:

GET /api/fabric/device/status HTTP/1.1
Authorization: Bearer 'UNION/**/SELECT/**/token/**/INTO/**/OUTFILE/**/'../../lib/python3.10/site-packages/x.pth'--

This payload writes a malicious Python path configuration file, which executes when the Python environment loads. The use of /**/ instead of spaces bypasses basic SQLi filters. Successful exploitation grants attackers full control over the vulnerable server.

Detection and Mitigation

Organizations should immediately scan for vulnerable FortiWeb instances and apply patches. For temporary mitigation, disable HTTP/HTTPS admin interfaces if not required. Monitor logs for unusual Authorization headers containing SQL syntax. Fortinet’s advisory (FG-IR-25-151) provides additional detection guidance.

Security teams should prioritize reviewing:

Component	Action
FortiWeb API traffic	Block requests with SQL keywords in headers
File system	Monitor for unexpected `.pth` files in Python directories
Network access	Restrict management interface access to trusted IPs

Broader Context

This vulnerability follows a pattern of critical flaws in Fortinet products, including recent SSL-VPN zero-days (CVE-2023-27997, CVE-2024-21762) and FortiADC/FortiAnalyzer vulnerabilities. The rapid release of PoC exploits increases the risk of widespread attacks, particularly from ransomware groups like Black Basta that actively target network infrastructure.

Fortinet has faced criticism for delayed vulnerability disclosures in the past. This incident underscores the importance of timely patching and proactive monitoring of network devices. Organizations using affected products should review their patch management processes and ensure security teams are alerted to Fortinet advisories.

Conclusion

The public release of FortiWeb RCE exploits demands immediate action from organizations using vulnerable versions. Given the pre-authentication nature of this flaw and the availability of working PoCs, unpatched systems are at high risk of compromise. Security teams should prioritize patching, monitor for exploitation attempts, and review related Fortinet product vulnerabilities across their environments.