Fortinet FortiWeb Flaw Actively Exploited in the Wild Before Company's Silent Patch

Cybersecurity researchers warn of an authentication bypass vulnerability in Fortinet FortiWeb that could let attackers take over admin accounts and fully compromise a device. According to The Hacker News, the flaw was patched in FortiWeb version 8.0.2, and in-the-wild exploitation has focused on adding a new administrator account as a persistence mechanism, a finding highlighted by watchTowr CEO Benjamin Harris.

The researchers reproduced the vulnerability, producing a working PoC and releasing an artifact generator tool to help identify susceptible devices. Defused and security researcher Daniel Card of PwnDefend noted the payload targets the path “/api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi” via an HTTP POST to create an admin account, with observed usernames and passwords such as Testpoint and trader1 listed in the report.

As of writing, Fortinet has not issued a CVE or a PSIRT advisory, and Rapid7 has urged organisations with FortiWeb versions pre-dating 8.0.2 to patch urgently, while the origins of the threat actor remain unknown.