Detect Fortinet FortiWeb Heap-Based Buffer Overflow Exploitation (CVE-2025-25249) in Microsoft Sentinel
Detects exploitation attempts and indicators of compromise associated with CVE-2025-25249, a heap-based buffer overflow (CWE-122 / CWE-787 out-of-bounds write) affecting multiple Fortinet products. Listed in the CISA KEV catalog, this vulnerability can be triggered by malformed HTTP/HTTPS requests to affected Fortinet management or proxy interfaces, potentially leading to memory corruption, denial of service, or remote code execution. This detection surfaces anomalous requests, crash/restart telemetry, and post-exploitation activity on affected Fortinet appliances.
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
let fortinetHosts = dynamic(["FortiWeb", "FortiGate", "FortiProxy", "FortiOS"]);
CommonSecurityLog
| where DeviceVendor == "Fortinet"
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL) or isnotempty(Message)
| where Message has_any ("heap", "buffer overflow", "segfault", "daemon crash", "httpsd", "proxyd", "restart", "signal 11", "core dump")
or RequestURL has_any ("%00", "../", "..%2f")
| extend RequestLength = strlen(RequestURL)
| where RequestLength > 2000 or Message has_any ("segfault", "signal 11", "core dump", "daemon crash")
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, RequestURL, RequestMethod, Message, RequestLength
| sort by TimeGenerated descIdentifies malformed or oversized HTTP requests to Fortinet appliances alongside daemon crash/restart syslog messages consistent with heap corruption from CVE-2025-25249.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate large HTTP POST uploads or API payloads exceeding the length threshold
- Scheduled or administrator-initiated Fortinet daemon restarts during upgrades
- Vulnerability scanners probing management interfaces generating malformed requests
Other platforms for CVE-2025-25249
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Oversized HTTP request to Fortinet management interface
Expected signal: Fortinet syslog/CEF record with a RequestURL length exceeding 2000 bytes from the test source IP.
- Test 2Null-byte and traversal encoded request
Expected signal: Fortinet log entry containing %00 and ../ sequences in the request URL.
- Test 3Simulated Fortinet daemon crash log injection
Expected signal: Synthetic Fortinet syslog message containing 'signal 11', 'segfault', and 'core dump' strings.
References (4)
- https://fortiguard.fortinet.com/psirt/FG-IR-25-084
- https://nvd.nist.gov/vuln/detail/CVE-2025-25249
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
Response Playbook
Triage
- Confirm the affected Fortinet product and firmware version against FG-IR-25-084 to determine whether it is in the vulnerable range for CVE-2025-25249.
- Review the source IP(s) of the malformed/oversized requests and check whether they are known, expected clients or external/unknown addresses; enrich with threat intelligence.
- Examine the Fortinet appliance crash/restart logs (httpsd, proxyd, or relevant daemon) to determine whether a crash actually occurred coincident with the suspicious request.
- Correlate the timing of the request with any subsequent anomalous administrative logins, configuration changes, or new admin accounts on the appliance.
Containment
- Restrict access to the affected Fortinet management/proxy interface to trusted management networks only, and block the identified malicious source IP(s) at the perimeter.
- Apply the vendor patch from FG-IR-25-084 immediately or, if patching is not yet possible, disable the affected exposed service/interface as a temporary mitigation.
- If compromise is suspected, isolate the appliance from untrusted networks and route traffic through a redundant/backup device where available.
Evidence Collection
- Capture and preserve the full Fortinet appliance syslog, crash logs, and any core dumps generated around the event for forensic analysis.
- Export the raw HTTP request payloads and packet captures targeting the appliance to document the exploitation attempt.
Escalation Criteria
- !Escalate to incident response if a daemon crash is confirmed together with subsequent unauthorized configuration changes, new admin accounts, or outbound connections from the appliance.
- !Escalate to the security leadership and vendor (Fortinet PSIRT) if the appliance is internet-facing and confirmed running a vulnerable firmware version with active exploitation observed.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Fortinet appliance crash logs and core dumps for httpsd/proxyd daemons - >
Syslog entries showing daemon restarts and memory faults - >
Configuration change audit logs and admin session records post-event
Tuning Guidance
Baseline the normal maximum URL/request length for applications behind FortiWeb/FortiProxy to set an appropriate length threshold and reduce false positives from legitimate large payloads. Whitelist known vulnerability scanners and maintenance windows where planned daemon restarts occur. Prioritize alerts where a malformed/oversized request is immediately followed by a crash event from the same source IP.
Hunting Queries
Hunts for clusters of Fortinet daemon crash/restart events over time that may indicate repeated exploitation attempts against CVE-2025-25249.
CommonSecurityLog | where DeviceVendor == "Fortinet" | where Message has_any ("segfault", "core dump", "daemon crash", "signal 11") | summarize count() by DestinationIP, bin(TimeGenerated, 1h)index=fortinet vendor="Fortinet" (msg="*segfault*" OR msg="*core dump*" OR msg="*daemon crash*") | timechart span=1h count by dest_ipAtomic Red Team Tests
Sends an HTTP request with an extremely long URL to a lab Fortinet appliance to simulate a malformed request that triggers the length-based detection.
Command
python3 -c "import urllib.request; urllib.request.urlopen('https://fortinet-lab.local/' + 'A'*3000)" || trueCleanup
echo 'No cleanup required; request is stateless'Expected Telemetry
Fortinet syslog/CEF record with a RequestURL length exceeding 2000 bytes from the test source IP.
Expected Detection
KQL/SPL rules fire on RequestLength > 2000 to a Fortinet appliance.
Sends a request containing null-byte and path-traversal encodings to a lab appliance to simulate malformed input associated with the overflow trigger.
Command
curl -k "https://fortinet-lab.local/api/v2/%00../%2e%2e/config" || trueCleanup
echo 'No cleanup required'Expected Telemetry
Fortinet log entry containing %00 and ../ sequences in the request URL.
Expected Detection
Detection rules match the malformed URL regex patterns (%00, ../).
Injects a synthetic Fortinet daemon crash syslog message into a lab SIEM forwarder to validate crash-indicator detection logic.
Command
logger -n siem-lab.local -P 514 -t fortinet 'date=2026-09-10 devname=FortiWeb-LAB msg="httpsd daemon crash: signal 11 (segfault), core dump written"'Cleanup
echo 'No cleanup required; log entry is synthetic'Expected Telemetry
Synthetic Fortinet syslog message containing 'signal 11', 'segfault', and 'core dump' strings.
Expected Detection
Detection rules match crash-indicator keywords in the message/payload field.