Fortinet FortiWeb unauthenticated RCE

Classification basis

The module's primary purpose is to gain unauthorized remote code execution. It actively exploits two vulnerabilities: it sends a crafted request to bypass authentication and create an admin user, then uses that access to inject and execute an arbitrary OS command payload. The module type is 'exploit', and the code contains the full exploit logic.

Requirements

• Network access to the FortiWeb management interface (default port 443).modules/exploits/linux/http/fortinet_fortiweb_rce.rb:103-105
• Target must be a vulnerable version of FortiWeb (e.g., 8.0.1, 7.4.8, 6.4.3, 6.3.9).modules/exploits/linux/http/fortinet_fortiweb_rce.rb:25-42

Observed behavior

• Sends a POST request to /api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi with a crafted CGIINFO header to bypass authentication and create a new local administrator account.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:539-556
• Logs in with the newly created or supplied admin credentials to obtain an authenticated session cookie (APSCOOKIE_FWEB).modules/exploits/linux/http/fortinet_fortiweb_rce.rb:170-188
• Retrieves the target's major, minor, and patch version via the /api/v2.0/system/state endpoint to select the appropriate command injection technique.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:428-463
• Leverages a command injection in the SAML user configuration CLI (via HTTP CLI console for v6 or WebSocket for v7/v8) to write a base64-encoded bootstrap payload to disk in chunks, then decodes and executes it.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:213-299modules/exploits/linux/http/fortinet_fortiweb_rce.rb:413-426
• The bootstrap payload uses Python to detach the final Metasploit payload (e.g., reverse shell) from the CLI session to prevent premature termination.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:226-232

Observables

Exploit Chain

CVE-2025-64446 auth bypass -> CVE-2025-58034 command injectionThe module first creates a new admin account via a path traversal (lines 152-166, 478-537), then logs in (lines 170-190), and finally executes a payload via command injection through the CLI (lines 202-208, 213-299). This is the documented exploit behavior.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:152-166modules/exploits/linux/http/fortinet_fortiweb_rce.rb:170-190modules/exploits/linux/http/fortinet_fortiweb_rce.rb:202-208

Payload Execution

Base64-encoded bootstrap payload written in chunks and executed via `base64 -d|sh`The module uploads a bootstrap payload in chunks to avoid command length limits (lines 213-298). The bootstrap payload uses Python's subprocess.Popen to detach the final Metasploit payload (lines 216-232). This is a standard technique for reliable session delivery.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:213-232modules/exploits/linux/http/fortinet_fortiweb_rce.rb:262-298

Credential Creation

Random admin username and password generated via Faker and Rex::TextIf no credentials are supplied, the module creates a new local admin account with random credentials (lines 152-160). This is necessary for the exploit and is not a backdoor; the credentials are printed to the operator.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:152-160