## https://sploitus.com/exploit?id=4BC76409-FADB-5D37-B566-DC80296B5CCF
# CVE-2025-25257 Detection Engineering Repository
---
## Overview
This repository provides production-ready detection engineering content for **CVE-2025-25257**, a pre-authentication SQL Injection vulnerability in Fortinet FortiWeb Fabric Connector versions 7.0 through 7.6.x. Successful exploitation can lead to Remote Code Execution without any prior authentication.
This content is intended for **defensive use only**. It is scoped for Security Operations Centre (SOC) teams, detection engineers, and threat hunters. No weaponised exploit code is included.
---
## Vulnerability Summary
| Field | Detail |
|---|---|
| CVE | CVE-2025-25257 |
| EDB-ID | 52473 |
| Product | Fortinet FortiWeb |
| Affected Versions | 7.0.x through 7.6.x |
| Vulnerability Type | Pre-authentication SQL Injection leading to RCE |
| Attack Vector | HTTP API endpoint (unauthenticated) |
| Authentication Required | None |
| CVSS Score | 9.8 (Critical) |
| Patch Available | Yes, upgrade to 7.6.1 or later |
| Published | 2026-02-04 |
| Researcher | Milad Karimi (Ex3ptionaL) |
---
## Vulnerability Description
CVE-2025-25257 affects the Fabric Connector API endpoint `/api/fabric/device/status` in FortiWeb. The `Authorization` header is passed directly into a SQL query without sanitisation. An unauthenticated attacker can inject SQL syntax into the Bearer token value to manipulate the underlying query, bypass authentication, and in certain configurations achieve Remote Code Execution through SQL-based command stacking or file write primitives.
The vulnerability is exploitable over the network with no credentials. It is trivially detectable in HTTP access logs if log collection is in place.
---
## Exploitation Method
The attacker sends a crafted HTTP GET request to the Fabric Connector API. The Bearer token in the `Authorization` header contains injected SQL. Example pattern:
```
Authorization: Bearer aaa' OR '1'='1
```
This causes the backend SQL query to evaluate as true, bypassing token validation. Further exploitation may involve UNION-based injection to read data or stacked queries to write files or execute OS commands depending on the database configuration and privileges.
---
## Example PoC Payload (Reference Only)
The following is documented for detection rule validation purposes only.
```http
GET /api/fabric/device/status HTTP/1.1
Host:
Authorization: Bearer aaa' OR '1'='1
```
Detection rules in this repository are tuned to identify this and similar injection patterns in HTTP logs and network traffic.
---
## Detection Coverage Table
| ID | Category | Detection Method | Source | Coverage Level |
|---|---|---|---|---|
| D-01 | Web Request Exploitation | SQLi pattern in Authorization header | Web/Proxy Logs, WAF | High |
| D-02 | Web Request Exploitation | Requests to `/api/fabric/device/status` without valid token | Web Logs | High |
| D-03 | Process Execution Anomaly | Shell process spawned by web server process | EDR / Sysmon | High |
| D-04 | Process Execution Anomaly | `sh`, `bash`, `python` child of nginx or httpd | EDR | High |
| D-05 | Suspicious File Creation | Web shell written to FortiWeb web root | EDR / File Integrity | Medium |
| D-06 | Suspicious File Creation | Unexpected `.php`, `.jsp`, `.py` in web directories | File Monitoring | Medium |
| D-07 | Persistence Mechanism | Cron job modification post-exploitation | EDR / Auditd | Medium |
| D-08 | Persistence Mechanism | New admin account created via API post-SQLi | API / Auth Logs | High |
| D-09 | Container Activity | Abnormal process in FortiWeb container namespace | Container Runtime | Medium |
| D-10 | Threat Hunting | Baseline deviation in Fabric Connector API call rate | SIEM / Analytics | Medium |
| D-11 | Threat Hunting | Source IPs making repeated 200/403 patterns to `/api/fabric/` | Web Logs | High |
| D-12 | Config Tampering | Changes to FortiWeb config files after web request | File Integrity / EDR | High |
| D-13 | Config Tampering | Unexpected writes to `/data/` or `/etc/` on appliance | Auditd / EDR | Medium |
---
## YARA Rules
YARA rules are located in `rules/yara/`.
### Files
- `cve_2025_25257_http.yar` - Detects exploitation patterns in HTTP log files and captured traffic
- `cve_2025_25257_webshell.yar` - Detects web shells potentially dropped post-exploitation
- `cve_2025_25257_payload.yar` - Detects raw payload artifacts on disk
### Usage
Scan HTTP access logs:
```bash
yara -r rules/yara/cve_2025_25257_http.yar /var/log/fortiweb/
```
Scan web root for dropped files:
```bash
yara -r rules/yara/cve_2025_25257_webshell.yar /var/www/html/
```
Scan captured PCAP:
```bash
yara rules/yara/cve_2025_25257_http.yar capture.pcap
```
Run all rules recursively against a directory:
```bash
yara -r rules/yara/ /path/to/scan/
```
---
## KQL Queries
KQL queries are located in `rules/kql/`. Each file targets a specific detection category.
| File | Description |
|---|---|
| `01_web_exploitation.kql` | SQL injection patterns in Authorization header |
| `02_process_spawn.kql` | Anomalous child processes from web server |
| `03_command_execution.kql` | Suspicious command execution chains |
| `04_file_creation.kql` | Unexpected file writes in web directories |
| `05_persistence.kql` | Persistence mechanism indicators |
| `06_config_modification.kql` | Configuration file tampering |
| `07_threat_hunting.kql` | Advanced threat hunting query |
---
## Sigma Rules
Sigma rules are in `rules/sigma/`. These can be converted to any SIEM format using `sigma-cli` or `pySigma`.
Convert to Splunk SPL:
```bash
sigma convert -t splunk rules/sigma/cve_2025_25257_sqli.yml
```
Convert to Elastic EQL:
```bash
sigma convert -t elasticsearch rules/sigma/cve_2025_25257_sqli.yml
```
---
## Testing Instructions
### Verify Affected Version
On the FortiWeb appliance CLI:
```bash
get system status | grep Version
```
Affected: `7.0.x` through `7.6.0`
Patched: `7.6.1` and later
### Docker Lab Setup
A basic Nginx reverse proxy simulating the vulnerable endpoint can be used for detection testing. No actual FortiWeb image is required for log-based detection validation.
```bash
# Pull the test lab container
docker run -d \
--name fortiweb-sim \
-p 8443:443 \
-v $(pwd)/src/lab/nginx.conf:/etc/nginx/nginx.conf:ro \
nginx:alpine
# Send a simulated exploitation request
curl -k -H "Authorization: Bearer aaa' OR '1'='1" \
https://localhost:8443/api/fabric/device/status
```
This will generate an access log entry matching the detection patterns in D-01.
### Verify Detection Triggers
After sending the test request, check the simulated log output:
```bash
docker logs fortiweb-sim | grep "fabric/device/status"
```
Expected log entry pattern:
```
"GET /api/fabric/device/status HTTP/1.1" 401 - "Bearer aaa' OR '1'='1"
```
Run the YARA rule against the log:
```bash
yara rules/yara/cve_2025_25257_http.yar /var/log/nginx/access.log
```
Expected output:
```
CVE_2025_25257_SQLi_AuthHeader /var/log/nginx/access.log
```
---
## Repository Structure
```
cve-2025-25257-detection/
โโโ README.md
โโโ LICENSE
โโโ .gitignore
โโโ rules/
โ โโโ yara/
โ โ โโโ cve_2025_25257_http.yar
โ โ โโโ cve_2025_25257_webshell.yar
โ โ โโโ cve_2025_25257_payload.yar
โ โโโ kql/
โ โ โโโ 01_web_exploitation.kql
โ โ โโโ 02_process_spawn.kql
โ โ โโโ 03_command_execution.kql
โ โ โโโ 04_file_creation.kql
โ โ โโโ 05_persistence.kql
โ โ โโโ 06_config_modification.kql
โ โ โโโ 07_threat_hunting.kql
โ โโโ sigma/
โ โ โโโ cve_2025_25257_sqli.yml
โ โ โโโ cve_2025_25257_process_spawn.yml
โ โโโ splunk/
โ โโโ web_exploitation.spl
โ โโโ process_anomaly.spl
โโโ docs/
โ โโโ iocs.md
โ โโโ mitre_attack.md
โ โโโ false_positive_analysis.md
โโโ src/
โ โโโ poc.py
โ โโโ lab/
โ โโโ nginx.conf
โโโ sysmon/
โโโ sysmon_config_snippet.xml
```
---
## References
- [FortiWeb Security Advisory FG-IR-25-007](https://www.fortiguard.com/psirt)
- [ExploitDB Entry 52473](https://www.exploit-db.com/exploits/52473)
- [MITRE ATT&CK T1190 - Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
- [OWASP SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection)
- [Fortinet PSIRT Advisory Portal](https://www.fortiguard.com/psirt)
---
## Credits
- **Vulnerability Discovery and PoC**: Milad Karimi (Ex3ptionaL), miladgrayhat@gmail.com
- **Detection Engineering**: This repository
- **MITRE ATT&CK Framework**: MITRE Corporation
---
## Disclaimer
This repository is provided for **defensive and educational purposes only**. All detection content is intended to help security teams identify and respond to exploitation attempts. Do not use any content in this repository against systems you do not own or have explicit written permission to test.
---
## License
This project is licensed under the MIT License. See [LICENSE](LICENSE) for details.