Fortinet FortiWeb SSO Login Authentication Bypass (FG-IR-25-647)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(277981);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id("CVE-2025-59718", "CVE-2025-59719");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/12/23");
  script_xref(name:"IAVA", value:"2025-A-0770-S");

  script_name(english:"Fortinet FortiWeb SSO Login Authentication Bypass (FG-IR-25-647)");

  script_set_attribute(attribute:"synopsis", value:
"Fortinet Firewall is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by multiple
vulnerabilities as referenced in the FG-IR-25-647 advisory.

  - An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0,...
    (CVE-2025-59719)

  - A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3,
    FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0
    through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through
    7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an
    unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response
    message. (CVE-2025-59718)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.fortiguard.com/psirt/FG-IR-25-647");
  script_set_attribute(attribute:"solution", value:
"For 7.4.x, upgrade to FortiWeb version 7.4.10 or later. For 7.6.x, upgrade to FortiWeb version 7.6.5 or later. For
8.0.x, upgrade to FortiWeb version 8.0.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-59719");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:fortinet:fortiweb");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Firewalls");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("fortinet_version.nbin");
  script_require_keys("Host/Fortigate/model", "Host/Fortigate/version");

  exit(0);
}

include('vcf_extras_fortios.inc');

var app_name = 'FortiWeb';
var app_info = vcf::get_app_info(app:app_name, kb_ver:'Host/Fortigate/version');
vcf::fortios::verify_product_and_model(product_name:app_name);

var constraints = [
  { 'min_version' : '7.4.0', 'max_version' : '7.4.9', 'fixed_version' : '7.4.10' },
  { 'min_version' : '7.6.0', 'max_version' : '7.6.4', 'fixed_version' : '7.6.5' },
  { 'min_version' : '8.0.0', 'fixed_version' : '8.0.1' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);