CVE-2025-25257 Critical FortiWeb SQL Injection Leading to RCE

🔐 Vulnerability Summary

• CVE ID: CVE-2025-25257
• Product Affected: Fortinet FortiWeb – A Web Application Firewall (WAF)
• Vulnerability Type: Unauthenticated SQL Injection (CWE-89)
• Impact: Full system compromise via Remote Code Execution (RCE)
• CVSS v3.1 Base Score: 9.8 (Critical)
• Attack Vector: Network (pre-auth, no credentials required)

📌 Description

This vulnerability allows unauthenticated remote attackers to perform SQL injection attacks on FortiWeb appliances by manipulating Bearer tokens passed to the administrative interface. By chaining SQL injection with the misuse of the MySQL “SELECT INTO OUTFILE” command and Python package hijacking techniques, attackers can escalate to arbitrary code execution with root privileges.

📅 Disclosure and Patch Timeline

📂 Affected Versions

• 7.6.0 – 7.6.3 Vulnerable
• 7.4.0 – 7.4.7 Vulnerable
• 7.2.0 – 7.2.10 Vulnerable
• 7.0.0 – 7.0.10 Vulnerable Below 7.0 Likely not affected (older architecture)

✅ Fixed Versions:

• 7.6.4
• 7.4.8
• 7.2.11
• 7.0.11

🧬 Technical Details

1. Vulnerability Location:
   • Found in the get_fabric_user_by_token function in FortiWeb’s backend logic.
2. Injection Point:
   • A malicious Bearer token in an HTTP Authorization header is processed insecurely.
3. SQL Injection Exploitation:
   • Crafted SQL allows execution of: SELECT '<payload>' INTO OUTFILE '/usr/lib/python3/dist-packages/hax.pth';
   • This abuses MySQL’s file writing capability to drop a .pth file into a Python path.
4. Privilege Escalation to RCE:
   • Once the .pth file is written, any Python process (such as FortiWeb’s admin interface) auto-executes the malicious code on next execution, achieving root RCE.
5. Persistence:
   • Root shell access allows attackers to create cron jobs, modify system binaries, or open reverse shells.

🚨 Risk and Exploitability

• Pre-auth: No credentials or session required.
• Remote: Exploitable over network via HTTP/HTTPS.
• Rapid weaponization: Public PoC tools now available.
• Root-level RCE: Full compromise of the device possible.
• Critical business risk for enterprises relying on FortiWeb to protect sensitive applications.

🔍 Indicators of Compromise (IOCs)

• Unusual .pth files in /usr/lib/python3/dist-packages/
• Unexpected outbound connections from FortiWeb appliance
• Presence of suspicious tokens or malformed headers in access logs
• Modified CGI scripts or additional Python files on the system

🛡️ Mitigation and Remediation

🔧 Official Patches:

• Apply latest firmware for your FortiWeb version:
  • FortiWeb Downloads

🚫 Temporary Workarounds:

• Disable the HTTP/HTTPS admin interface on external networks
• Restrict access to FortiWeb GUI to trusted IPs via ACLs or VPN

🕵️ Detection Tools:

• Use the watchTowr PoC & validator:
  • GitHub repo: https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257
• Deploy IDS rules matching SQL injection patterns in Bearer tokens
• Monitor logs for anomalies in token usage or file creation activity

📝 Security Best Practices

• Always isolate security appliances (like WAFs) from public access
• Enforce least privilege for system services
• Use WAF log monitoring, central SIEM alerting, and anomaly detection
• Regularly patch critical infrastructure per vendor advisories

📣 Fortinet’s Official Response

• Advisory: FortiGuard PSIRT FG-IR-25-151
• Recommends immediate upgrade and GUI lockdown
• Fortinet credits WatchTowr Labs for responsible disclosure