CVE-2025-25255 PoC — Fortinet FortiOS和Fortinet FortiProxy 安全特征问题漏洞

Source

https://github.com/chjkfbvmvff/CVE-2025-25255

Associated Vulnerability

Title:Fortinet FortiOS和Fortinet FortiProxy 安全特征问题漏洞 (CVE-2025-25255)
Description:An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0.1 through 7.0.22 may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.

Description

CVE-2025-25255

Readme

# watchTowr-vs-Fortiweb-AuthBypass

Detection Artifact Generator for FortiWeb Authentication Bypass


See our [blog post](https://labs.watchtowr.com/) for technical details


# Detection in Action

```
python watchTowr-vs-Fortiweb-AuthBypass.py 192.168.1.99
                         __         ___  ___________
         __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________
         \ \/ \/ \__  \    ___/ ___\|  |  \|    | /  _ \ \/ \/ \_  __ \
          \     / / __ \|  | \  \___|   Y  |    |(  <_> \     / |  | \/
           \/\_/ (____  |__|  \___  |___|__|__  | \__  / \/\_/  |__|
                                  \/          \/     \/

        watchTowr-vs-Fortiweb-AuthBypass.py

        (*) FortiWeb Authentication Bypass Artifact Generator

          - Sina Kheirkhah (@SinSinology) and Jake Knott (@inkmoro) of watchTowr (@watchTowrcyber)

        CVEs: [CVE-2025-xxxxx]

[+] Exploit sent successfully.
[*] Check for the new user [ 35f36895 ] with password [ 35f36895 ]


```

# Description

This script attempts to detect if FortiWeb is vulnerable to Authentication Bypass

# Affected Versions

FortiWeb Versions Below 8.0.2 are affected, for more specific versions please contact [FortiGuard Labs PSIRT](https://fortiguard.fortinet.com/)


# Follow [watchTowr](https://watchTowr.com) Labs

For the latest security research follow the [watchTowr](https://watchTowr.com) Labs Team 

- https://labs.watchtowr.com/
- https://x.com/watchtowrcyber

File Snapshot


 [4.0K]  /data/pocs/6f3664da877167d020968d76de1c0657f97eb249
├── [1.4K]  README.md
└── [2.9K]  watchTowr-vs-Fortiweb-AuthBypass.py

1 directory, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!