FortiWeb `cgi-bin/fwbcgi` Path Traversal Authentication Bypass Leading to Rogue Admin Creation (CVE-2025-64446)

Metadata

Affected Target

Summary

FortiWeb exposes an internal CGI handler (cgi-bin/fwbcgi) that is reachable through the authenticated cmdb REST API path by appending a relative path-traversal sequence (../) after a request to a nonexistent object (admin%3f). Because path handling for the internal CGI target happens outside the access-control check tied to the /api/v2.0/cmdb/... prefix, the traversal routes the request to the internal CGI handler while bypassing the authentication gate that would normally apply to it. The handler additionally trusts a CGIINFO HTTP header — a base64-encoded JSON blob asserting an authenticated admin identity — without independently verifying a valid session. The PoC combines both bugs to submit an unauthenticated “add local user” request that creates a brand-new, fully privileged local administrator account with no source-IP restriction (trusthostv4/trusthostv6 = 0.0.0.0/0 / ::/0). Once this rogue admin account exists, an attacker can log in normally and, per the repository’s documentation, chain into CVE-2025-58034 (an authenticated OS command injection in the SAML user CLI configuration flow) for full device compromise.

Vulnerability Details

Root Cause

The exploit targets the following endpoint, which appends a traversal sequence after a bogus object name to escape the cmdb API’s authentication scope and land on the internal fwbcgi CGI binary:

POST /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi

The request also carries a CGIINFO header — base64-encoded JSON that the backend appears to trust as an already-authenticated session context instead of re-deriving identity from a validated session/cookie:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

cgiinfo_json = {
    "username": "admin",
    "profname": "prof_admin",
    "vdom": "root",
    "loginname": "admin"
}
cgiinfo_b64 = base64.b64encode(json.dumps(cgiinfo_json).encode()).decode()
headers = {
    "CGIINFO": cgiinfo_b64,
    "Content-Type": "application/x-www-form-urlencoded",
}

The JSON body sent alongside it is a standard FortiWeb cmdb “add local admin user” payload (q_type: 1) with access-profile: prof_admin (super-admin equivalent) and no trusted-host restriction, so a successful response (HTTP 200) means a new, fully privileged admin account was silently created without ever authenticating.

Attack Vector

1. Attacker sends an unauthenticated POST to /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi on the target FortiWeb’s management/API interface.
2. The trailing ../../../../../ traversal collapses the path down to cgi-bin/fwbcgi, which is processed outside the access-control logic bound to the cmdb API prefix.
3. The CGIINFO header (base64 JSON asserting username=admin, profname=prof_admin, vdom=root) is accepted by the CGI handler as a trusted session/authorization context.
4. The POST body instructs the backend to add a new local user with attacker-chosen username/password, access-profile=prof_admin, and trusthostv4=0.0.0.0/0 / trusthostv6=::/0 (unrestricted source access).
5. A 200 response confirms the rogue admin account now exists; the attacker logs in through the normal GUI/CLI using the newly created credentials.
6. (Documented chain) Once authenticated, the attacker can exploit CVE-2025-58034 by editing a SAML user’s entity name with a shell metacharacter payload (e.g. edit "id") inside config user saml-user, causing FortiWeb to break out of the configuration parser and execute the injected OS command.

Impact

• Complete unauthenticated bypass of FortiWeb’s administrative authentication.
• Creation of a fully privileged, network-reachable (unrestricted trusted-host) admin account.
• Chainable into authenticated OS command injection (CVE-2025-58034) for full appliance compromise, and by extension compromise of the trust placed in the WAF protecting downstream web applications.

Environment / Lab Setup

Target:   FortiWeb appliance, firmware in the vulnerable range listed above,
          management/API HTTPS interface reachable on port 443.
Attacker: Python 3
          Standard library only (http.client, ssl, base64, json, argparse, uuid)
          NOTE: the script as committed does `import slogsec` and calls
          `slogsec.get_logger("api")` for output logging. `slogsec` is not a
          published/available Python package — replace those two lines with
          Python's standard `logging` module (or simple print statements)
          before running. This is the only change needed; the request/exploit
          logic itself is unmodified from the source repository.

Proof of Concept

PoC Script

See exploit.py in this folder.

1
2
3

python3 exploit.py <TARGET_IP_OR_HOSTNAME>

python3 exploit.py <TARGET_IP_OR_HOSTNAME> -u customadmin -p custompassword

On success the script prints the newly created admin username/password, which can then be used to log into the FortiWeb GUI/CLI as a super-admin.

Detection & Indicators of Compromise

- HTTP POST requests to URIs matching:
  /api/v2.0/cmdb/system/*%3f/../*cgi-bin/fwbcgi
  (path-traversal sequences preceding cgi-bin/fwbcgi)
- Presence of a "CGIINFO" request header carrying base64-encoded JSON on
  otherwise unauthenticated requests
- New entries in `config system admin` with:
    - trusthostv4 0.0.0.0/0 and/or trusthostv6 ::/0
    - unexplained creation time with no corresponding legitimate admin login
    - short/random usernames (e.g. 8-character UUID fragments)
- Subsequent CLI activity under `config user saml-user` containing shell
  metacharacters (backticks, $()) in the `edit` object name — indicator of
  the CVE-2025-58034 follow-on command injection

Signs of compromise:

• Unrecognized local admin accounts with unrestricted trusted hosts.
• FortiWeb admin login events from unfamiliar source IPs shortly after a new account’s creation timestamp.
• Unexpected outbound connections or process execution originating from the FortiWeb appliance itself.

Remediation

References

• Source repository
• CVE-2025-64446 — NVD
• CVE-2025-58034 — NVD

Notes

Mirrored from https://github.com/litndat/Vulnerability-CVE-2025-64446-CVE-2025-58034 on 2026-07-06. The repository’s original README is written in Vietnamese and documents both CVE-2025-64446 (this entry) and the chained CVE-2025-58034 authenticated OS command injection. The included exploit.py imports a non-existent slogsec module (import slogsec, log = slogsec.get_logger("api")) — this is not a published PyPI package, so the script fails at import time until those lines are swapped for standard logging/print calls. Aside from that import issue, the HTTP request construction, CGIINFO header, and API payload match the documented real-world FortiWeb auth-bypass technique.