CVE-2025-58034 Microsoft Sentinel · KQL

Detect Fortinet FortiWeb OS Command Injection (CVE-2025-58034) in Microsoft Sentinel

Detects exploitation of CVE-2025-58034, an OS command injection vulnerability (CWE-78) in Fortinet FortiWeb. This KEV-listed vulnerability allows attackers to inject and execute arbitrary OS commands through FortiWeb's management or inspection interfaces, potentially leading to full appliance compromise, lateral movement, and persistent access to network segmentation points.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Lateral Movement

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
union isfuzzy=true
(
  CommonSecurityLog
  | where DeviceVendor =~ "Fortinet" and DeviceProduct =~ "FortiWeb"
  | where AdditionalExtensions has_any ("cmd_injection", "os_command", "shell_exec", "command_injection")
      or Message has_any (";", "&&", "||", "`", "$(")
      or RequestURL has_any ("%3B", "%7C", "%26%26", "%60", "%24%28")
  | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, RequestURL, Message, Activity, Severity, AdditionalExtensions
),
(
  Syslog
  | where ProcessName has_any ("httpsd", "wad", "fortiweb")
  | where SyslogMessage has_any ("cmd_injection", "os_command", "command injection", "shell", "execve", "/bin/sh", "/bin/bash")
  | project TimeGenerated, HostName, ProcessName, SyslogMessage
),
(
  AzureActivity
  | where ResourceProviderValue =~ "Microsoft.Network"
  | where OperationNameValue has_any ("FortiWeb", "Fortinet")
  | where ActivityStatusValue =~ "Failed"
)
| extend CVE = "CVE-2025-58034"
| sort by TimeGenerated desc
critical severity medium confidence

Hunts for OS command injection exploitation attempts against Fortinet FortiWeb appliances using CommonSecurityLog, Syslog, and AzureActivity tables. Looks for shell metacharacters in URLs and known FortiWeb process anomalies.

Data Sources

CommonSecurityLogSyslogAzureActivity

Required Tables

CommonSecurityLogSyslog

False Positives & Tuning

  • Legitimate FortiWeb administrative activity involving shell-like characters in URLs
  • Security scanners or vulnerability assessment tools probing FortiWeb management interfaces
  • URL-encoded characters in normal web traffic passing through FortiWeb inspection
  • FortiWeb health checks or monitoring agents generating similar log patterns

Other platforms for CVE-2025-58034

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1FortiWeb Command Injection via URI Path Semicolon Delimiter

    Expected signal: FortiWeb access logs showing HTTP GET request to /cgi-bin/module;id;whoami from test IP. CommonSecurityLog entry with RequestURL containing semicolons.

  2. Test 2FortiWeb Command Injection via URL-Encoded Shell Metacharacters

    Expected signal: FortiWeb logs showing request URL containing %3B sequence. Network proxy or WAF logs showing URL-decoded form with semicolons.

  3. Test 3Simulated Post-Exploitation Shell Spawn from Web Process

    Expected signal: Process execution log showing /bin/bash spawned with parent process www-data or httpsd equivalent. File creation event for /tmp/fortiweb_compromise_marker.txt.

  4. Test 4FortiWeb Management Interface Credential Stuffing and Command Injection Attempt

    Expected signal: FortiWeb authentication log showing POST to management API with injection payload in password field. CommonSecurityLog DeviceAction showing authentication attempt with anomalous credential content.

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the source IP and determine whether it belongs to a known administrator, security scanner, or external threat actor. Cross-reference with threat intelligence feeds and IP reputation services.
  2. Examine the raw HTTP request payload in FortiWeb logs for the specific URI path, query string, POST body, or HTTP header containing the injected shell metacharacters (e.g., `;`, `&&`, `|`, backtick, `$(`).
  3. Determine whether the injection attempt succeeded by correlating FortiWeb application logs with OS-level process execution logs: look for unexpected child processes spawned by httpsd or wad daemon (e.g., /bin/sh, /bin/bash, wget, curl, nc).
  4. Check FortiWeb system integrity indicators: look for new cron jobs, unauthorized user accounts, modified configuration files, or unexpected outbound network connections from the FortiWeb management IP.

Containment

  1. Immediately isolate the affected FortiWeb appliance from the network by disabling management access ACLs or placing it behind an emergency firewall rule blocking all inbound connections to management ports (80, 443, 8080, 8443) from unauthorized sources.
  2. Revoke all active administrative sessions on the FortiWeb appliance and rotate all credentials (admin passwords, API keys, certificates) stored on or associated with the device. Notify downstream systems that use FortiWeb for authentication or inspection.

Evidence Collection

  1. Capture and preserve full FortiWeb system logs (/var/log/), application logs, and traffic logs before any remediation. Export to a forensically sound, write-protected storage location with cryptographic hash verification.
  2. Collect a memory dump and disk image of the FortiWeb appliance if physically or virtually accessible, to preserve volatile artifacts such as injected command history, modified in-memory configurations, and active network connections (netstat -antp output).

Escalation Criteria

  • !Escalate immediately to incident response if any successful OS command execution is confirmed (e.g., child shell process observed, unauthorized file creation, outbound C2 connection from FortiWeb IP), as this represents full appliance compromise.
  • !Escalate if the FortiWeb appliance has access to internal network segments, as a compromised WAF is a high-value pivot point for lateral movement into protected application tiers, databases, or internal administrative networks.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >FortiWeb access logs showing HTTP requests with shell metacharacters (;, &&, |, `, $()) in URI paths, query strings, or POST bodies
  • >OS process execution logs on FortiWeb showing /bin/sh or /bin/bash spawned as children of httpsd or wad
  • >Crontab entries (/var/spool/cron/crontabs/, /etc/cron.d/) added after the exploitation timestamp
  • >New or modified files in /tmp, /var/tmp, or FortiWeb configuration directories created during the attack window
  • >Outbound network connections from the FortiWeb management IP to external IPs not in the approved management network

Tuning Guidance

Start with a 7-day baseline of FortiWeb log volume and establish allowlists for known management IP ranges and authorized scanner IPs. Tune the URL pattern matching to exclude legitimate application paths that use semicolons or pipes in query parameters by adding `not (RequestURL startswith "/api/allowed-path")` clauses. If false positive rates remain high from security scanners, add a suppression rule for known scanner user-agent strings. Increase confidence to 'high' once you have confirmed the FortiWeb version is within the affected range and have correlated network-layer detections with process-level telemetry showing shell spawning.

Hunting Queries

Threat hunting query for historical FortiWeb log review spanning 30 days, looking for HTTP requests containing OS command interpreter invocations or download utility references that may indicate successful exploitation or post-exploitation activity.

Hunting — KQL
kql 
CommonSecurityLog
| where DeviceVendor =~ "Fortinet" and DeviceProduct =~ "FortiWeb"
| where TimeGenerated > ago(30d)
| where RequestURL has_any ("/bin/sh", "/bin/bash", "wget", "curl ", "nc ", "ncat", "python -c", "perl -e")
    or AdditionalExtensions has "process_name=/bin/"
| summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)
| where count_ > 3
| sort by count_ desc
Hunting — SPL
spl 
index=network sourcetype=fortinet:fortiweb earliest=-30d
| where match(uri_path, "(?i)(\/bin\/sh|\/bin\/bash|wget |curl |netcat|nc |python -c|perl -e)")
   OR match(msg, "(?i)(os.command|shell.exec|execve|\/bin\/sh)")
| stats count by src_ip, uri_path, msg
| where count > 2
| sort - count

Atomic Red Team Tests

Test 1 FortiWeb Command Injection via URI Path Semicolon Delimiter
linux

Simulates an OS command injection attempt against a FortiWeb management or inspection endpoint by injecting a semicolon-delimited shell command into the URI path. Lab use only.

Command

bash 
curl -sk 'https://TARGET_FORTIWEB_IP/cgi-bin/module;id;whoami' -H 'User-Agent: Mozilla/5.0' --max-time 10 -o /tmp/fortiweb_test_output.txt && cat /tmp/fortiweb_test_output.txt

Cleanup

bash 
rm -f /tmp/fortiweb_test_output.txt

Expected Telemetry

FortiWeb access logs showing HTTP GET request to /cgi-bin/module;id;whoami from test IP. CommonSecurityLog entry with RequestURL containing semicolons.

Expected Detection

KQL and SPL queries matching on RequestURL containing ';' pattern from non-admin source IP

Test 2 FortiWeb Command Injection via URL-Encoded Shell Metacharacters
linux

Tests detection of URL-encoded OS command injection payload (%3B = ';', %7C = '|') that may bypass simple string matching but should be caught by URL-decode-aware detections.

Command

bash 
curl -sk 'https://TARGET_FORTIWEB_IP/api/v1/config%3Bid%3Bwhoami' -H 'Content-Type: application/json' --max-time 10 -v 2>&1 | tee /tmp/fortiweb_encoded_test.txt

Cleanup

bash 
rm -f /tmp/fortiweb_encoded_test.txt

Expected Telemetry

FortiWeb logs showing request URL containing %3B sequence. Network proxy or WAF logs showing URL-decoded form with semicolons.

Expected Detection

Queries matching on URL-encoded metacharacter patterns (%3B, %7C, %26%26) in RequestURL or uri_path fields

Test 3 Simulated Post-Exploitation Shell Spawn from Web Process
linux

On a test Linux host representing a compromised FortiWeb, simulates an attacker spawning a shell from a web server process to validate process-lineage detections.

Command

bash 
sudo -u www-data /bin/bash -c 'id && whoami && hostname && cat /etc/passwd | head -5 && echo CVE-2025-58034-test > /tmp/fortiweb_compromise_marker.txt'

Cleanup

bash 
rm -f /tmp/fortiweb_compromise_marker.txt

Expected Telemetry

Process execution log showing /bin/bash spawned with parent process www-data or httpsd equivalent. File creation event for /tmp/fortiweb_compromise_marker.txt.

Expected Detection

Elastic EQL sequence detection correlating web process parent with /bin/bash child spawn. CrowdStrike ProcessRollup2 event showing shell child of web daemon.

Test 4 FortiWeb Management Interface Credential Stuffing and Command Injection Attempt
linux

Simulates an attacker attempting to authenticate and inject commands via FortiWeb's management API endpoint, combining credential abuse with command injection payload.

Command

bash 
curl -sk -X POST 'https://TARGET_FORTIWEB_IP/api/v2.0/cmdb/system/admin' -H 'Content-Type: application/json' -d '{"username":"admin","password":"admin$(id)"}' --max-time 10 -o /tmp/fortiweb_api_test.txt 2>&1; cat /tmp/fortiweb_api_test.txt

Cleanup

bash 
rm -f /tmp/fortiweb_api_test.txt

Expected Telemetry

FortiWeb authentication log showing POST to management API with injection payload in password field. CommonSecurityLog DeviceAction showing authentication attempt with anomalous credential content.

Expected Detection

Detections matching on POST body containing $() subshell syntax or shell metacharacters in authentication fields

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix ShellT1053.003Cron

Same Tactic: Initial Access

Popular Detections