Full Report
A Fortinet FortiWeb path traversal vulnerability is being actively exploited to create new administrative users on exposed devices without requiring authentication [...]
Analysis Summary
# Vulnerability: FortiWeb Path Traversal leading to Unauthenticated Admin Account Creation
## CVE Details
- CVE ID: Not explicitly provided in the text.
- CVSS Score: Not explicitly provided in the text. Report suggests critical impact due to unauthenticated RCE/Account creation.
- CWE: Path Traversal (Implied)
## Affected Systems
- Products: Fortinet FortiWeb
- Versions: 8.0.1 and earlier.
- Configurations: Devices with management interfaces exposed to the internet.
## Vulnerability Description
This is a Path Traversal vulnerability in the FortiWeb API endpoint `/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi`. Threat actors are sending unauthenticated HTTP POST requests to this path containing specific payloads. This allows the attacker to execute arbitrary commands within the context of the application, specifically used to forge system requests that create new local administrative accounts on the targeted device without any prior authentication.
## Exploitation
- Status: Exploited in the wild
- Complexity: Low (Implied by the ability to spray the exploit globally and the public PoC)
- Attack Vector: Network (External access to the management interface)
## Impact
- Confidentiality: High (Potential for full system access post-account creation)
- Integrity: Critical (Ability to create persistent, high-privilege administrative accounts)
- Availability: Medium (Risk of disruption or ongoing compromise following successful exploitation)
## Remediation
### Patches
- **FortiWeb 8.0.2** (Brought out near the end of October, per the article)
### Workarounds
1. Immediately restrict access to FortiWeb management interfaces so they are **not reachable from the internet**.
2. Limit access to trusted internal networks or require VPN-only access.
3. **Review devices for unauthorized administrative accounts** created with unusual usernames (e.g., _Testpoint_, _trader1_, _trader_).
## Detection
- **Indicators of Compromise (IOCs):**
- Presence of newly created user accounts with suspicious names (e.g., _Testpoint_, _trader1_).
- HTTP requests targeting the path involving `fwbcgi` or the specific API endpoint `/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi`.
- Traffic originating from known malicious IP addresses: 107.152.41.19, 144.31.1.63, 185.192.70.0/24 range, 64.95.13.8.
- **Detection Methods and Tools:**
- Monitor web server/WAF logs for the specified path traversal sequences.
- Use security tools to check the system for non-standard administrative users.
- Researchers have released a proof-of-concept tool ("FortiWeb Authentication Bypass Artifact Generator") that defenders can use to scan for the vulnerability, though caution should be exercised if using third-party tools.
## References
- Vendor Advisory: No specific PSIRT disclosure was found matching the exploited vulnerability at the time of reporting.
- Relevant Links (Defanged):
- bleepingcomputer com/news/security/fortiweb-flaw-with-public-poc-actively-exploited-to-create-admin-users/
- pwndefend com/2025/11/13/suspected-fortinet-zero-day-exploited-in-the-wild/
- github com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass (PoC tool)