Fortinet FortiWeb OS Command Injection (CVE-2025-58034)

union isfuzzy=true
(
  CommonSecurityLog
  | where DeviceVendor =~ "Fortinet" and DeviceProduct =~ "FortiWeb"
  | where AdditionalExtensions has_any ("cmd_injection", "os_command", "shell_exec", "command_injection")
      or Message has_any (";", "&&", "||", "`", "$(")
      or RequestURL has_any ("%3B", "%7C", "%26%26", "%60", "%24%28")
  | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, RequestURL, Message, Activity, Severity, AdditionalExtensions
),
(
  Syslog
  | where ProcessName has_any ("httpsd", "wad", "fortiweb")
  | where SyslogMessage has_any ("cmd_injection", "os_command", "command injection", "shell", "execve", "/bin/sh", "/bin/bash")
  | project TimeGenerated, HostName, ProcessName, SyslogMessage
),
(
  AzureActivity
  | where ResourceProviderValue =~ "Microsoft.Network"
  | where OperationNameValue has_any ("FortiWeb", "Fortinet")
  | where ActivityStatusValue =~ "Failed"
)
| extend CVE = "CVE-2025-58034"
| sort by TimeGenerated desc

index=network sourcetype IN ("fortinet:fortiweb", "fortigate_utm", "syslog")
(vendor="Fortinet" OR product="FortiWeb" OR host=*fortiweb*)
(
  [search index=network sourcetype IN ("fortinet:fortiweb", "syslog")
   (uri_path="*;*" OR uri_path="*|*" OR uri_path="*&&*" OR uri_path="*`*" OR uri_path="*$(*"
    OR request="*%3B*" OR request="*%7C*" OR request="*%26%26*" OR request="*%60*" OR request="*%24%28*"
    OR msg="*cmd_injection*" OR msg="*os_command*" OR msg="*command injection*"
    OR process IN ("/bin/sh", "/bin/bash", "cmd.exe") | return src_ip]
)
| eval cve="CVE-2025-58034", risk="critical"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as uri_paths values(src_ip) as source_ips by host, dest_ip, cve
| where count > 0
| sort - last_seen

sequence by host.name with maxspan=5m
  [network where event.dataset == "fortinet.fortiweb"
   and (url.path : ("*;*", "*|*", "*&&*", "*`*", "*$(*")
        or url.query : ("*%3B*", "*%7C*", "*%26%26*", "*%60*", "*%24%28*")
        or event.action : ("*cmd_injection*", "*command_injection*", "*os_command*"))]
  [process where host.os.type == "linux"
   and process.name in ("/bin/sh", "/bin/bash", "sh", "bash")
   and process.parent.name in ("httpsd", "wad", "node", "python", "perl")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  URL,
  "Message",
  devicevendor,
  deviceproduct,
  username,
  QIDNAME(qid) AS event_name,
  RULENAME(creEventList) AS triggered_rules
FROM events
WHERE
  (devicevendor ILIKE '%fortinet%' OR deviceproduct ILIKE '%fortiweb%')
  AND (
    URL ILIKE '%;%' OR URL ILIKE '%|%' OR URL ILIKE '%&&%'
    OR URL ILIKE '%`%' OR URL ILIKE '%$(%'
    OR URL ILIKE '%25 3B%' OR URL ILIKE '%25 7C%'
    OR "Message" ILIKE '%cmd_injection%'
    OR "Message" ILIKE '%os_command%'
    OR "Message" ILIKE '%command injection%'
    OR "Message" ILIKE '%/bin/sh%'
    OR "Message" ILIKE '%/bin/bash%'
  )
  AND LOGSOURCETYPENAME(devicetype) IN ('Fortinet FortiWeb', 'Fortinet FortiGate', 'Syslog')
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=*fortiweb* OR _sourceCategory=*fortinet*
| where (%"vendor"="Fortinet" OR %"product"="FortiWeb" OR _raw matches /(?i)fortiweb/)
| where (
    %"uri" matches /.*;.*/ OR %"uri" matches /.*\|.*/ OR %"uri" matches /.*&&.*/
    OR %"uri" matches /.*`.*/ OR %"uri" matches /.*\$\(.*/
    OR %"request" matches /.*%3B.*/ OR %"request" matches /.*%7C.*/
    OR _raw matches /(?i)(cmd_injection|os_command|command.injection|\/bin\/sh|\/bin\/bash)/
  )
| parse regex field=_raw "src=(?P<src_ip>[\d\.]+)" nodrop
| parse regex field=_raw "dst=(?P<dst_ip>[\d\.]+)" nodrop
| parse regex field=_raw "url=(?P<url>[^\s]+)" nodrop
| count by src_ip, dst_ip, url, _sourceHost
| sort by _count desc
| fields src_ip, dst_ip, url, _sourceHost, _count

rule fortiweb_os_command_injection_cve_2025_58034 {
  meta:
    author = "df00tech"
    description = "Detects OS command injection exploitation against Fortinet FortiWeb (CVE-2025-58034)"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2025-58034"
    reference = "https://fortiguard.fortinet.com/psirt/FG-IR-25-513"

  events:
    (
      $e.metadata.product_name = /(?i)fortiweb/ or
      $e.metadata.vendor_name = /(?i)fortinet/
    )
    (
      $e.network.http.request_url = /[;|`]|&&|\$\(/ or
      $e.network.http.request_url = /%3B|%7C|%26%26|%60|%24%28/ or
      $e.security_result.summary = /(?i)(cmd.inject|os.command|command.inject|shell.exec)/ or
      $e.target.process.command_line = /\/bin\/sh|\/bin\/bash/
    )

  condition:
    $e
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=ProcessRollup2
| device_type = "FortiWeb" OR CommandLine = /(?i)(fortiweb|httpsd|wad)/
| (
    RemotePort IN (80, 443, 8080, 8443)
    AND (
      CommandLine = /(\/bin\/sh|\/bin\/bash|cmd\.exe)\ -[ci]/ OR
      CommandLine = /;|&&|\|\||`|\$\(/ OR
      UrlPath = /(%3B|%7C|%26%26|%60|%24%28)/
    )
  )
| groupBy([aid, ComputerName, CommandLine, UrlPath, RemoteAddressIP4], function=count())
| sort(count, order=desc)