Ò»¡¢·ì϶¸ÅÊö
·ìϼûû³Æ | FortiWeb API Óë CLI ¶à´¦ºÅÁî×¢Èë·ì϶ |
CVE ID | CVE-2025-58034 |
·ì϶ÀàÐÍ | ºÅÁî×¢Èë·ì϶ | ·¢ÏÖ¹¦·ò | 2025-11-20 |
·ì϶ÆÀ·Ö | 7.2 | ·ì϶µÈ¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | ¸ß |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ²»±ØÒª |
PoC/EXP | Òѹ«¿ª | ÔÚÒ°ÀûÓà | ÒÑ·¢ÏÖ |
Fortinet FortiWebÊÇFortinet¹«Ë¾ÍƳöµÄWebÀûÓ÷À»ðǽ£¨WAF£©£¬£¬£¬£¬£¬ÓÃÓÚ±£»£»£»£»£»¤ÍøÕ¾ºÍWebÀûÓÃÃâÊÜSQL×¢Èë¡¢¿çÕ¾¾ç±¾£¨XSS£©¡¢ÎļþÔ̺¬µÈ³£¼û¹¥»÷¡£¡£¡£¡£¡£¡£¡£¡£ËüÖ§³Ö»ùÓÚÕ½ÊõµÄÁ÷Á¿¼ì²â¡¢Ðé¹¹²¹¶¡¡¢API°²È«ºÍ»úе½ø¹¹ÖþÄ££¬£¬£¬£¬£¬ºÏÓÃÓÚÆóÒµ¼¶ÀûÓ÷À»¤£¬£¬£¬£¬£¬³£²¿ÊðÓÚÊý¾ÝÖÐÐÄ¡¢ÔÆƽ̨ºÍ»ìºÏ»·¾³ÖУ¬£¬£¬£¬£¬¿ÉÓëFortinet°²È«Éú̬ϵͳ¼¯³É£¬£¬£¬£¬£¬ÊµÏÖ¶¯Ì¬°²È«·À»¤¡£¡£¡£¡£¡£¡£¡£¡£
2025Äê11ÔÂ20ÈÕ£¬£¬£¬£¬£¬8827Ì«Ñô¼¯Íż¯ÍÅVSRC¼à²âµ½Ò»¸öÓ°ÏìFortiWebµÄ²Ù×÷ϵͳºÅÁî×¢Èë·ì϶£¬£¬£¬£¬£¬¸Ã·ì϶ԴÓÚAPIÓëCLI½Ó¿Ú¶ÔÊäÈëÄÚÈݲ»×ãÓÐЧ¹ýÂË£¬£¬£¬£¬£¬ÔÊÐí¾¹ýÉí·ÝÑéÖ¤µÄ¹¥»÷Õßͨ¹ý»ú¹ØÌض¨µÄHTTPÒªÇó»òCLIÖ¸Á£¬£¬£¬£¬½«¶ñÒâºÅÁî×¢ÈëϵͳÖв¢Ôڵײã²Ù×÷ϵͳÉÏÖ´ÐÓ×£¡£¡£¡£¡£¡£¡£¡£³É¹¦ÀûÓô˷ì϶µÄ¹¥»÷Õß¿É»ñÈ¡³¬³öÊÚȨÁìÓòµÄÖ´ÐÐȨÏÞ£¬£¬£¬£¬£¬´Ó¶ø¿ÉÄܵ¼ÖÂϵͳ±»ÆëÈ«½ÚÔì¡¢ÅäÖÃÔâ´Û¸Ä»ò½øÒ»²½ºáÏòÉøÈë¡£¡£¡£¡£¡£¡£¡£¡£
¶þ¡¢Ó°ÏìÁìÓò
8.0.0 <= FortiWeb <= 8.0.17.6.0 <= FortiWeb <= 7.6.57.4.0 <= FortiWeb <= 7.4.107.2.0 <= FortiWeb <= 7.2.117.0.0 <= FortiWeb <= 7.0.11
Èý¡¢°²È«´ëÊ©
3.1 Éý¼¶°æ±¾
¹Ù·½ÒÑ°ä²¼½¨¸´²¹¶¡£¬£¬£¬£¬£¬ÒÔ½¨¸´¸Ã·ì϶¡£¡£¡£¡£¡£¡£¡£¡£
ÏÂÔØÁ´½Ó£ºhttps://fortiguard.fortinet.com/psirt/FG-IR-25-513/
3.2 һʱ´ëÊ©
ÔÝÎÞ¡£¡£¡£¡£¡£¡£¡£¡£
3.3 ͨÓý¨Òé
? ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬£¬£¬Ï÷¼õϵͳ·ì϶£¬£¬£¬£¬£¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£¡£¡£¡£¡£¡£¡£¡£? ¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÔ죬£¬£¬£¬£¬Åú¸Ä·À»ðǽսÊõ£¬£¬£¬£¬£¬¹Ø¹Ø·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ£¬£¬£¬£¬£¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Â¶³öµ½¹«Íø£¬£¬£¬£¬£¬Ï÷¼õ¹¥»÷Ãæ¡£¡£¡£¡£¡£¡£¡£¡£? ʹÓÃÆóÒµ¼¶°²È«²úÆ·£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£¡£¡£¡£¡£¡£¡£¡£? ¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬ÆôÓöà³É·ÖÈÏÖ¤»úÔìºÍ×îÓ×ȨÏÞ×¼Ôò£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£¡£¡£¡£¡£? ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£¡£¡£¡£¡£¡£¡£¡£
3.4 ²Î¿¼Á´½Ó
https://fortiguard.fortinet.com/psirt/FG-IR-25-513/https://nvd.nist.gov/vuln/detail/CVE-2025-58034
¾©¹«Íø°²±¸11010802024551ºÅ