CVE-2025-25257 – SQLi in FortiWeb Fabric Connector leading to RCE

Background

In July 2025, security researchers at Pwner disclosed a critical vulnerability in FortiWeb appliances.
Tracked as CVE-2025-25257, this issue originates from a SQL injection in the Fabric Connector component, which can be escalated into remote code execution (RCE) with no authentication required.

This vulnerability underscores once again how a single injection flaw, if chained properly, can lead to complete appliance compromise.

Root Cause

• The fabric_device_status-handler endpoint processes HTTP headers (such as Authorization).
• Input is concatenated directly into SQL queries without proper sanitization.
• The SQL engine runs with elevated privileges, granting read/write capabilities on the filesystem.
• By abusing this, an attacker can drop a malicious Python file that gets automatically executed by a FortiWeb CGI script.

In short, what begins as a SQLi becomes a pre-auth RCE through file planting and interpreter hijacking.

Exploitation Flow

1. Send crafted HTTP request to trigger SQL injection via headers.
2. Leverage DB access to write arbitrary files on disk.
3. Plant malicious Python module in a location imported by FortiWeb CGI.
4. Trigger CGI execution, gaining remote code execution.

This chain is not only practical but highly reliable once initial injection is confirmed.

Impact

• Full compromise of the FortiWeb appliance.
• Remote attackers can pivot into protected networks behind the WAF.
• Potential interception, modification, or exfiltration of sensitive data passing through the device.

Affected Versions

• 7.6.0 → 7.6.3
• 7.4.0 → 7.4.7
• 7.2.0 → 7.2.10
• Any version below 7.0.11

Detection & Hunting

Defenders should look for indicators across multiple layers:

• HTTP logs: suspicious Authorization headers containing injection patterns (', --, /*, UNION SELECT).
• Database activity: unusual queries involving INTO OUTFILE.
• File system monitoring: unexpected creation of .py files in FortiWeb directories.
• SIEM correlation: Fabric API calls followed by file creation and CGI execution.

Mitigation & Patching

Fortinet has released patches for all affected branches. Immediate recommendations:

1. Upgrade to the latest fixed version.
2. Restrict exposure of Fabric APIs to trusted networks only.
3. Enable file integrity monitoring on FortiWeb directories.
4. Consider implementing WAF rules temporarily to block suspicious requests until fully patched.

References

• Pwner blog – FortiWeb Fabric Connector RCE
• WatchTowr research – deep dive into exploit chain
• ZeroPath advisories – affected versions and practical risk notes