An auth bypass + path traversal in Fortinet FortiWeb to create new administrative users on exposed devices without requiring authentication.
Blog:
• https://www.rapid7.com/blog/post/et...y-in-fortinet-fortiweb-exploited-in-the-wild/
• https://labs.watchtowr.com/when-the...ersonate-users-fortinet-fortiweb-auth-bypass/
Tweet:
Metasploit module: https://github.com/rapid7/metasploit-framework/pull/20698
Dork:
ZoomEye Dork: app="FortiWeb"
HUNTER: product.name="FortiWeb"
Shodan: http.title:FortiWeb
Affected versions:
• 8.0: <8.0.2
• 7.6: <7.6.5
• 7.4: <7.4.10
• 7.2: <7.2.12
• 7.0: <7.0.12
• 6.4: <= 6.4.3
• 6.3: <= 6.3.23