FortiWeb Fabric Connector Pre-Auth SQLi to RCE
- Product
- Fortinet FortiWeb
- CVE
- CVE-2025-25257
- Disclosed
- 2025-07-08
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- FortiWeb 7.6.0-7.6.3, 7.4.0-7.4.7, 7.2.0-7.2.10, 7.0.0-7.0.10.
- Fixed
- FortiWeb 7.6.4, 7.4.8, 7.2.11, 7.0.11.
Summary
An unauthenticated SQL injection in the FortiWeb Fabric Connector API could be escalated to remote code execution. watchTowr published a full analysis and exploitation started shortly after, with webshells observed on internet-facing FortiWeb devices.
Root cause
The Fabric Connector status endpoint copies the bearer token from the Authorization header into a SQL query with string formatting instead of parameterization. Because the MySQL account can write files, injection can drop a Python .pth file into site-packages, which a CGI Python script then executes.
Impact
Unauthenticated code execution on the web application firewall.
Detection
Look for Authorization headers containing quotes or SQL keywords against /api/fabric/device/status and unexpected .pth files in Python site-packages. Version-check against fixed builds.
Mitigation
Upgrade; as a workaround disable the HTTP/HTTPS administrative interface on exposed interfaces.