U.S. CISA adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fortinet FortiWeb flaw, tracked as CVE-2025-25257, to its Known Exploited Vulnerabilities (KEV) catalog.

Hackers began exploiting the critical Fortinet FortiWeb flaw CVE-2025-25257 (CVSS score of 9.6) on the same day a proof-of-concept (PoC) exploit was published, leading to dozens of compromised systems. Exploitation of Fortinet’s CVE-2025-25257 began on July 11 after the PoC was published.

The flaw is a SQL injection vulnerability in FortiWeb (CWE-89) that allows unauthenticated attackers to execute unauthorized SQL commands via crafted HTTP/HTTPS requests.

“An improper neutralization of special elements used in an SQL command (‘SQL Injection’) vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.” reads the advisory.

Fortinet addressed the issue with the release of security patches in versions 7.6.4, 7.4.8, 7.2.11, and 7.0.11.

Kentaro Kawane from GMO Cybersecurity reported this vulnerability under responsible disclosure.

In a recent analysis, WatchTowr researchers conducted a binary diffing comparison of Fortinet’s httpsd service between versions 7.6.3 and 7.6.4. This approach allowed them to discover the specific changes introduced in the new version to address the issue, ultimately revealing the presence of a security patch.

Once the unauthenticated SQL injection vulnerability was discovered, researchers explored how to escalate it to remote code execution. They explored using MySQL’s INTO OUTFILE statement, which allows writing arbitrary files to the server’s filesystem, typically with limited mysql user privileges.

However, in this case, due to a misconfiguration, files could be written as root, enabling more impactful exploits. Their first attempt to achieve code execution by dropping a web shell into a CGI-enabled directory failed, as the files weren’t executable. They then pivoted to a more creative method.

They found an existing Python script (ml-draw.py) in the CGI directory, executed by Apache via /bin/python. Leveraging this, they used a lesser-known Python feature: .pth files. When placed in Python’s site-packages directory, .pth files can execute arbitrary code if they include a line like import os.

Despite challenges with file size limits and path constraints in INTO OUTFILE, they eventually bypassed them using a relative file path and by extracting payload chunks from the database itself. Ultimately, they successfully executed code by crafting and placing a .pth file that ran their desired Python code when the CGI script was triggered.

watchTowr researchers created a Detection Artifact Generator for FortiWeb CVE-2025-25257 that is available here.

Shadowserver researchers observed 85 FortiWeb hacks drop to 35 by July 18. The first exploitation attempts occurred on July 11, shortly after watchTowr released the PoC exploit code.

Censys found over 20,000 Fortinet FortiWeb devices online, though many aren’t clearly exposed. Due to limited info, their vulnerability status remains unknown.

“At the time of writing, Censys observed 20,098 Fortinet FortiWeb appliances online (honeypots excluded), though many did not appear to be directly exposed. A large number of hosts returned error codes (500/503), possibly due to filtering, but this does not guarantee they are fully protected. Note that we cannot identify version information for any of these hosts, so inferring vulnerability status is not possible.”  reads the advisory published by Censys. “This Censys Platform query can be used to identify FortiWeb devices that did not filter out requests.  

web.software: (vendor=”fortinet” and product=”fortiweb”) and web.endpoints.http.status_code=200 and not web.endpoints.http.html_title = “Endpoint Security Required” and not web.labels.value = “HONEYPOT””

Administrators are strongly advised to apply patches immediately due to the availability of public exploits.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerabilities by August 08, 2025.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)