Defused

Metasploit · Author

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

Metasploit

Fortinet FortiWeb unauthenticated RCE

Metasploit exploitby sfewer-r7Added to Metasploit 2025-11-21ExploitCVE-2025-58034CVE-2025-644461 file

exploit_linux/http/fortinet_fortiweb_rce · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This is a Metasploit exploit module that chains CVE-2025-64446 (authentication bypass via path traversal) to create an admin account, then uses CVE-2025-58034 (command injection) to execute an arbitrary OS command payload with root privileges on Fortinet FortiWeb.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a standard exploit chain for CVE-2025-64446 (auth bypass) and CVE-2025-58034 (command injection) against Fortinet FortiWeb. All actions—creating an admin account, logging in, uploading a payload, and executing it—are consistent with the stated exploit purpose. No concealed, deceptive, or operator-directed harmful behavior unrelated to the exploit was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareFortinet FortiWeb
Attack typesauthentication bypasspath traversalcommand injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's primary purpose is to gain unauthorized remote code execution. It actively exploits two vulnerabilities: it sends a crafted request to bypass authentication and create an admin user, then uses that access to inject and execute an arbitrary OS command payload. The module type is 'exploit', and the code contains the full exploit logic.

modules/exploits/linux/http/fortinet_fortiweb_rce.rb:1-557modules/exploits/linux/http/fortinet_fortiweb_rce.rb:6modules/exploits/linux/http/fortinet_fortiweb_rce.rb:17-21

Requirements

  • Network access to the FortiWeb management interface (default port 443).modules/exploits/linux/http/fortinet_fortiweb_rce.rb:103-105
  • Target must be a vulnerable version of FortiWeb (e.g., 8.0.1, 7.4.8, 6.4.3, 6.3.9).modules/exploits/linux/http/fortinet_fortiweb_rce.rb:25-42

Observed behavior

  • Sends a POST request to /api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi with a crafted CGIINFO header to bypass authentication and create a new local administrator account.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:539-556
  • Logs in with the newly created or supplied admin credentials to obtain an authenticated session cookie (APSCOOKIE_FWEB).modules/exploits/linux/http/fortinet_fortiweb_rce.rb:170-188
  • Retrieves the target's major, minor, and patch version via the /api/v2.0/system/state endpoint to select the appropriate command injection technique.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:428-463
  • Leverages a command injection in the SAML user configuration CLI (via HTTP CLI console for v6 or WebSocket for v7/v8) to write a base64-encoded bootstrap payload to disk in chunks, then decodes and executes it.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:213-299modules/exploits/linux/http/fortinet_fortiweb_rce.rb:413-426
  • The bootstrap payload uses Python to detach the final Metasploit payload (e.g., reverse shell) from the CLI session to prevent premature termination.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:226-232
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
Payload withheldThe module first creates a new admin account via a path traversal (lines 152-166, 478-537), then logs in (lines 170-190), and finally executes a payload via command injection through the CLI (lines 202-208, 213-299). This is the documented exploit behavior.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:152-166modules/exploits/linux/http/fortinet_fortiweb_rce.rb:170-190modules/exploits/linux/http/fortinet_fortiweb_rce.rb:202-208
Payload Execution
Payload withheldThe module uploads a bootstrap payload in chunks to avoid command length limits (lines 213-298). The bootstrap payload uses Python's subprocess.Popen to detach the final Metasploit payload (lines 216-232). This is a standard technique for reliable session delivery.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:213-232modules/exploits/linux/http/fortinet_fortiweb_rce.rb:262-298
Credential Creation
Payload withheldIf no credentials are supplied, the module creates a new local admin account with random credentials (lines 152-160). This is necessary for the exploit and is not a backdoor; the credentials are printed to the operator.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:152-160
Review boundaries

What the analysis did not establish

  • Analysis is based on the module source code and metadata only; Metasploit framework mixins, libraries, and external payloads are not expanded.
  • The code was not executed; classification is based on static analysis of the provided text.
  • Only the module source code and metadata were reviewed; the Metasploit framework mixins, libraries, and external payloads referenced by the module were not included in the evidence and were not analyzed.
  • The review is limited to the supplied text; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Metasploit

Fortinet FortiWeb create new local admin

Metasploit auxiliary PoCby sfewer-r7Added to Metasploit 2025-11-14ExploitCVE-2025-644461 file

auxiliary_admin/http/fortinet_fortiweb_create_admin · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit auxiliary module exploits CVE-2025-64446, an authentication bypass via path traversal in Fortinet FortiWeb, to create a new local administrator account. It sends a crafted POST request to a path-traversed CGI endpoint with base64-encoded CGIINFO header, bypassing authentication to execute the administrative 'create user' command.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit auxiliary module that exploits CVE-2025-64446 to create a new admin account on vulnerable FortiWeb devices. All behavior is consistent with the stated purpose: sending a crafted HTTP POST request with a path traversal to bypass authentication and create a local admin user. No concealed, deceptive, or unrelated harmful actions were observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesRuby
Target softwareFortinet FortiWeb
Attack typesauthentication bypasspath traversalprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module actively exploits the vulnerability by sending a crafted request that bypasses authentication and creates a new admin user, which is the definition of an exploit. It does not merely check for the vulnerability; it performs the unauthorized action of account creation.

modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:17-19modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:89-128modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:155-171

Requirements

  • Target must be a vulnerable version of Fortinet FortiWeb (7.0.0-7.0.11, 7.2.0-7.2.11, 7.4.0-7.4.9, 7.6.0-7.6.4, 8.0.0-8.0.1).modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:19-26
  • Network access to the FortiWeb management interface (default port 443).modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:44-46

Observed behavior

  • Sends a POST request to '/api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi' with a base64-encoded CGIINFO header containing default admin credentials, bypassing authentication.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:155-171
  • Creates a new local administrator account with attacker-supplied username and password.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:89-128
  • Stores the newly created credentials in the Metasploit database.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:152
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Authentication Bypass
Payload withheldThe module uses a path traversal in the URI to bypass authentication, which is the core of the documented vulnerability.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:165
Credential Creation
Payload withheldThe module's run method sends a JSON payload to create a local admin user, consistent with the module description.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:90-128
Credential Storage
Payload withheldThe module stores the newly created username and password using the framework's credential storage API, which is normal for auxiliary modules that obtain credentials.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:152modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:174-200
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The module's actual runtime behavior and effectiveness are not verified; classification is based on the code's stated purpose and logic.
  • Only the module source code and metadata were reviewed. Framework mixins (e.g., HttpClient, AutoCheck) and libraries are not expanded, so their internal behavior is assumed to be standard Metasploit functionality.
  • The review does not assess the safety or reliability of the exploit itself; it only checks for backdoor or deceptive behavior within the provided artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.