Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy CVE-2025-24472

## https://sploitus.com/exploit?id=B2D3663F-3A55-5E4E-9D31-81E8DD2CE324
# CVE-2025-24472 — Fortinet FortiOS / FortiProxy Authentication Bypass

## Overview

CVE-2025-24472 is an authentication bypass vulnerability in Fortinet FortiOS and
FortiProxy. An unauthenticated attacker can craft specially formed CSF (Central
Security Fabric) proxy requests to gain super-admin privileges on affected
devices. The flaw carries a CVSS score of 8.1 and is known to be actively
exploited by ransomware groups including SuperBlack (Mora_001).

## Technical Details

- **CWE:** 288 — Authentication Bypass Using an Alternate Path or Channel
- **Root Cause:** Insufficient validation of CSF proxy requests allows an
  attacker to impersonate a trusted fabric device without proper credentials.
- **Attack Vector:** Network-based, unauthenticated
- **Impact:** Complete compromise of confidentiality, integrity, and
  availability (super-admin access).

## Affected Versions

| Product          | Affected Versions                                        |
|------------------|----------------------------------------------------------|
| FortiOS          | 7.0.0 – 7.0.16                                          |
| FortiProxy       | 7.2.0 – 7.2.12, 7.0.0 – 7.0.19                         |

### Prerequisites for Exploitation

1. Attacker knows the target device serial number.
2. Security Fabric feature is enabled on the target.

## Exploitation

The attacker sends a crafted HTTP request to the target's CSF proxy endpoint.
By manipulating the `Forwarded-For` or `Authorization` headers and embedding the
target serial number, the request is processed as originating from a trusted
fabric member. The device then grants super-admin privileges without requiring
valid credentials.

## Reproduction Steps

1. Identify a target running an affected FortiOS or FortiProxy version.
2. Obtain or enumerate the device serial number.
3. Send a crafted POST request to the CSF proxy endpoint with the serial
   number embedded in the request headers.
4. The target responds with a session token granting super-admin privileges.
5. Use the token to authenticate and access the device management interface.

## Proof of Concept

See [exploit.py](exploit.py) for a complete PoC script.

## Mitigation

- Upgrade to FortiOS 7.0.17+ or FortiProxy 7.2.13+ / 7.0.20+.
- Restrict access to the management interface to trusted IPs only.
- Disable Security Fabric if not required.
- Monitor logs for anomalous CSF proxy requests.

## References

- https://www.fortiguard.com/psirt/FG-IR-25-005
- https://attack.mitre.org/techniques/T1190/
- https://nvd.nist.gov/vuln/detail/CVE-2025-24472