Fortinet FortiWeb Multiple OS Command Injection (FG-IR-25-513)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(275774);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/12");

  script_cve_id("CVE-2025-58034");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/11/25");
  script_xref(name:"IAVA", value:"2025-A-0864-S");

  script_name(english:"Fortinet FortiWeb Multiple OS Command Injection (FG-IR-25-513)");

  script_set_attribute(attribute:"synopsis", value:
"Fortinet Firewall is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a
vulnerability as referenced in the FG-IR-25-513 advisory.

  - An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    vulnerability in FortiWeb may allow an authenticated attacker to execute unauthorized code on the
    underlying system via crafted HTTP requests or CLI commands. (CVE-2025-58034)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://fortiguard.fortinet.com/psirt/FG-IR-25-513");
  script_set_attribute(attribute:"solution", value:
"Upgrade to FortiWeb version 7.0.12, 7.2.12, 7.4.11, 7.6.6, or 8.0.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-58034");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Fortinet FortiWeb unauthenticated RCE');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/19");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:fortinet:fortiweb");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Firewalls");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("fortinet_version.nbin");
  script_require_keys("Host/Fortigate/model", "Host/Fortigate/version");

  exit(0);
}

include('vcf_extras_fortios.inc');

var app_name = 'FortiWeb';
var app_info = vcf::get_app_info(app:app_name, kb_ver:'Host/Fortigate/version');
vcf::fortios::verify_product_and_model(product_name:app_name);

var constraints = [
  { 'min_version' : '7.0.0', 'fixed_version' : '7.0.12' },
  { 'min_version' : '7.2.0', 'fixed_version' : '7.2.12' },
  { 'min_version' : '7.4.0', 'fixed_version' : '7.4.11' },
  { 'min_version' : '7.6.0', 'fixed_version' : '7.6.6' },
  { 'min_version' : '8.0.0', 'fixed_version' : '8.0.2' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);