Exploits for pre-auth Fortinet FortiWeb RCE flaw released, patch now

Proof-of-concept exploits have been released for a critical SQLi vulnerability in Fortinet FortiWeb that can be used to achieve pre-authenticated remote code execution on vulnerable servers.

FortiWeb is a web application firewall (WAF), which is used to protect web applications from malicious HTTP traffic and threats.

The FortiWeb vulnerability has a 9.8/10 severity score and is tracked as CVE-2025-25257. Fortinet fixed it last week in FortiWeb 7.6.4, 7.4.8, 7.2.11, and 7.0.11 and later versions.

“An improper neutralization of special elements used in an SQL command (‘SQL Injection’) vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests,” reads Fortinet’s advisory.

The flaw was discovered by Kentaro Kawane from GMO Cybersecurity, who also disclosed a static hardcoded password vulnerability in Cisco ISE last month.

FortiWeb pre-auth SQLi to pre-auth RCE

Today, cybersecurity firm WatchTowr and a security researcher known as “faulty *ptrrr” released technical write-ups and proof-of-concept exploits that open reverse shells or a web shell.

The flaw is found in FortiWeb’s Fabric Connector, which is software that synchronizes authentication and policy data between Fortinet products.

The software contains an unauthenticated SQL injection flaw in the get_fabric_user_by_token() function, which uses the following code to issue a MySQL query:

snprintf(s, 0x400u, "select id from fabric_user.user_table where token='%s'", a1);

This code did not properly sanitize the bearer token sent in HTTP request headers, allowing attackers to inject custom SQL into the header to achieve SQLi.

Attackers can trigger the flaw through HTTP requests to the /api/fabric/device/status endpoint by injecting SQL into the Authorization header (e.g., Bearer AAAAAA'or'1'='1), allowing attackers to bypass authentication checks.

The researchers were able to escalate the SQL injection to remote code execution by executing MySQL’s SELECT … INTO OUTFILE query via the SQLi flaw to create arbitrary files on the device. This allowed them to write a Python .pth file into the site‑packages directory.

As .pth files are automatically loaded and run when Python is executed, the researchers found a legitimate FortiWeb CGI Python script (/cgi-bin/ml‑draw.py) that could be used to launch the malicious code in the .pth file and achieve remote code execution.

As exploits are now public and widely available, it is strongly advised that admins prioritize installing the patches to prevent servers from being compromised.

At this time, there is no indication that the vulnerability is being actively exploited, but this will likely change in the near future.