Fortinet FortiWeb Vulnerability and Mitigation

 

A critical Fortinet FortiWeb vulnerability is currently being exploited in the wild using a public proof-of-concept (PoC). Here are the key details:

---

What is the flaw?

• It’s an authentication bypass / path traversal vulnerability in FortiWeb WAF.
• Exploitation allows attackers to create new admin accounts without authentication, giving full control of the device.
• The vulnerable endpoint is:

  /api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi
  

• Attackers send crafted HTTP POST requests to this path with payloads that create admin-level accounts.
  Example usernames seen: Testpoint, trader1, trader
  Example passwords: 3eMIXX43, AFT3$tH4ck, AFT3$tH4ckmet0d4yaga!n. [bleepingcomputer.com]

---

Affected Versions

• FortiWeb 8.0.1 and earlier are vulnerable.
• Fixed in 8.0.2 (released end of October 2025).
• No official CVE or advisory yet from Fortinet, but multiple security researchers confirmed the exploit works on older versions. [thehackernews.com]

---

Public Exploit

• A PoC was published by researchers and confirmed by watchTowr Labs.
• A tool called “FortiWeb Authentication Bypass Artifact Generator” was released to help defenders identify vulnerable devices.
• Rapid7 and Defused observed the exploit being sold on black-hat forums and actively used since early October. [securityaffairs.com]

---

Mitigation

• Update immediately to FortiWeb 8.0.2.
• Remove FortiWeb management interfaces from public internet.
• Check for:
  • Unexpected admin accounts.
  • Requests to /fwbcgi in logs.
  • Indicators of compromise from suspicious IPs (e.g., 107.152.41.19, 144.31.1.63, 185.192.70.0/24). [bleepingcomputer.com]

---

Why urgent?

• Exploitation is indiscriminate and global.
• Attackers can persist by creating admin accounts.
• If unpatched, assume compromise and perform full incident response. [thehackernews.com]

step-by-step incident response checklist for a suspected FortiWeb compromise via the authentication bypass vulnerability:

---

1. Immediate Containment

• Disconnect FortiWeb from the internet or restrict management access to trusted IPs only.
• Block suspicious IPs observed in logs (e.g., 107.152.41.19, 144.31.1.63, 185.192.70.0/24).
• Disable any unnecessary admin accounts immediately.

---

2. Verify Exploitation

• Check FortiWeb logs for requests to:

  /api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi
  

• Look for unexpected admin accounts:
  • Common attacker-created usernames: Testpoint, trader1, trader.
• Review system event logs for configuration changes or new accounts.

---

3. Preserve Evidence

• Export:
  • System logs.
  • Web server logs.
  • VPN logs (if applicable).
• Take a snapshot or backup of the current configuration for forensic analysis.

---

4. Eradication

• Update FortiWeb to version 8.0.2 or later (patch released end of October 2025).
• Remove any unauthorized accounts.
• Reset all admin passwords and PSKs.
• Rotate API keys and certificates if used.

---

5. Recovery

• Re-enable services only after:
  • Patch applied.
  • Logs reviewed.
  • No signs of persistence (e.g., scheduled tasks, scripts).
• Implement network segmentation for management interfaces.
• Enable two-factor authentication for all admin accounts.

---

6. Post-Incident Actions

• Conduct a full compromise assessment:
  • Were configs exfiltrated?
  • Were backdoors installed?
• Notify stakeholders and comply with regulatory reporting if required.
• Update SIEM with detection rules:
  • Alert on /fwbcgi requests.
  • Alert on new admin account creation.

---

Optional: Detection Rule Example (SIEM)

(event_type:"web" AND url:"/fwbcgi") OR
(event_type:"system" AND action:"create" AND object:"admin account")