Fortinet FortiWeb create new local admin

MetasploitMetasploit auxiliary PoCExploitRubyauxiliary_admin/http/fortinet_fortiweb_create_admin

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit auxiliary module exploits CVE-2025-64446, an authentication bypass via path traversal in Fortinet FortiWeb, to create a new local administrator account. It sends a crafted POST request to a path-traversed CGI endpoint with base64-encoded CGIINFO header, bypassing authentication to execute the administrative 'create user' command.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit auxiliary module that exploits CVE-2025-64446 to create a new admin account on vulnerable FortiWeb devices. All behavior is consistent with the stated purpose: sending a crafted HTTP POST request with a path traversal to bypass authentication and create a local admin user. No concealed, deceptive, or unrelated harmful actions were observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesRuby
Target softwareFortinet FortiWeb
Attack typesauthentication bypasspath traversalprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module actively exploits the vulnerability by sending a crafted request that bypasses authentication and creates a new admin user, which is the definition of an exploit. It does not merely check for the vulnerability; it performs the unauthorized action of account creation.

modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:17-19modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:89-128modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:155-171

Requirements

  • Target must be a vulnerable version of Fortinet FortiWeb (7.0.0-7.0.11, 7.2.0-7.2.11, 7.4.0-7.4.9, 7.6.0-7.6.4, 8.0.0-8.0.1).modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:19-26
  • Network access to the FortiWeb management interface (default port 443).modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:44-46

Observed behavior

  • Sends a POST request to '/api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi' with a base64-encoded CGIINFO header containing default admin credentials, bypassing authentication.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:155-171
  • Creates a new local administrator account with attacker-supplied username and password.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:89-128
  • Stores the newly created credentials in the Metasploit database.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:152
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Authentication Bypass
POST /api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgiThe module uses a path traversal in the URI to bypass authentication, which is the core of the documented vulnerability.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:165
Credential Creation
Creates a new admin account with user-supplied username and passwordThe module's run method sends a JSON payload to create a local admin user, consistent with the module description.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:90-128
Credential Storage
Stores created credentials in the Metasploit databaseThe module stores the newly created username and password using the framework's credential storage API, which is normal for auxiliary modules that obtain credentials.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:152modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:174-200
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The module's actual runtime behavior and effectiveness are not verified; classification is based on the code's stated purpose and logic.
  • Only the module source code and metadata were reviewed. Framework mixins (e.g., HttpClient, AutoCheck) and libraries are not expanded, so their internal behavior is assumed to be standard Metasploit functionality.
  • The review does not assess the safety or reliability of the exploit itself; it only checks for backdoor or deceptive behavior within the provided artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1