Critical Security Flaw in FortiWeb: Action Required for Users
Overview of the Vulnerability
Fortinet has recently issued a warning regarding a significant security vulnerability in their FortiWeb product, labeled CVE-2025-25257. This flaw poses a serious risk, allowing unauthorized attackers to execute arbitrary SQL commands on unprotected instances. This vulnerability has garnered a high severity rating, with a CVSS score of 9.6 out of 10, highlighting the urgent need for attention from users.
Understanding SQL Injection Risks
The core issue stems from an improper handling of special characters within SQL commands, classified as an SQL Injection vulnerability. According to Fortinet’s advisory, attackers can exploit this flaw by sending crafted HTTP requests that execute unauthorized SQL code, potentially compromising the integrity of database systems.
Affected Versions
Users of FortiWeb should verify their current software versions to determine if they are affected by this vulnerability. The following versions are confirmed to be at risk:
- FortiWeb 7.6.0 through 7.6.3 (Upgrade to 7.6.4 or higher)
- FortiWeb 7.4.0 through 7.4.7 (Upgrade to 7.4.8 or higher)
- FortiWeb 7.2.0 through 7.2.10 (Upgrade to 7.2.11 or higher)
- FortiWeb 7.0.0 through 7.0.10 (Upgrade to 7.0.11 or higher)
If you are running any of the above versions, it is crucial to upgrade to the latest version immediately.
Discovery and Technical Analysis
The flaw was identified by Kentaro Kawane from GMO Cybersecurity, who has been credited with reporting other critical issues in Cisco systems. Recent analysis by watchTowr Labs highlighted that this vulnerability is linked to a function named "get_fabric_user_by_token," which is part of the Fabric Connector component facilitating communication between FortiWeb and other Fortinet products.
This specific function is called by another function, "fabric_access_check," activated through several API endpoints such as:
/api/fabric/device/status/api/v[0-9]/fabric/widget/[a-z]+/api/v[0-9]/fabric/widget
The problem arises when attacker-controlled data is submitted through a Bearer token in the Authorization header of an HTTP request. This data is then directly integrated into SQL database queries without sufficient sanitization, enabling potential execution of harmful commands.
Escalation of Threats
The implications of this vulnerability extend beyond mere unauthorized access. Attackers could potentially execute a line of code to write query results into files on the operating system, given the query runs under the "mysql" user account. This level of access could allow malicious actors to extract sensitive data or disrupt system functionality.
Mitigation Strategies
Security researcher Sina Kheirkhah pointed out that the recently updated function now employs prepared statements rather than traditional query formats, which is a promising measure against standard SQL injection attempts.
In the interim, users are advised to disable the HTTP/HTTPS administrative interface to reduce exposure while awaiting the necessary patches. Given Fortinet devices have faced exploitation in the past, swift action in updating to the latest software version is crucial to safeguarding against potential attacks.
Importance of Timely Updates
In light of the critical nature of this vulnerability, it is imperative for FortiWeb users to prioritize immediate updates. Failure to do so could result in serious security breaches, impacting not only data integrity but also organizational reputation.
Stay informed and take proactive measures to protect your systems from this serious threat. For more updates on cybersecurity, follow us on Twitter and [LinkedIn].
