CVE-2025-58034 Splunk · SPL

Detect Fortinet FortiWeb OS Command Injection (CVE-2025-58034) in Splunk

Detects exploitation of CVE-2025-58034, an OS command injection vulnerability (CWE-78) in Fortinet FortiWeb. This KEV-listed vulnerability allows attackers to inject and execute arbitrary OS commands through FortiWeb's management or inspection interfaces, potentially leading to full appliance compromise, lateral movement, and persistent access to network segmentation points.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Lateral Movement

SPL Detection Query

Splunk (SPL)
spl 
index=network sourcetype IN ("fortinet:fortiweb", "fortigate_utm", "syslog")
(vendor="Fortinet" OR product="FortiWeb" OR host=*fortiweb*)
(
  [search index=network sourcetype IN ("fortinet:fortiweb", "syslog")
   (uri_path="*;*" OR uri_path="*|*" OR uri_path="*&&*" OR uri_path="*`*" OR uri_path="*$(*"
    OR request="*%3B*" OR request="*%7C*" OR request="*%26%26*" OR request="*%60*" OR request="*%24%28*"
    OR msg="*cmd_injection*" OR msg="*os_command*" OR msg="*command injection*"
    OR process IN ("/bin/sh", "/bin/bash", "cmd.exe") | return src_ip]
)
| eval cve="CVE-2025-58034", risk="critical"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as uri_paths values(src_ip) as source_ips by host, dest_ip, cve
| where count > 0
| sort - last_seen
critical severity medium confidence

Splunk search for OS command injection exploitation against Fortinet FortiWeb. Correlates shell metacharacter injection patterns in URI paths and known injection signatures from FortiWeb logs.

Data Sources

Fortinet FortiWeb logsSyslogNetwork proxy logs

Required Sourcetypes

fortinet:fortiwebfortigate_utmsyslog

False Positives & Tuning

  • Penetration testing or authorized red team exercises against FortiWeb
  • URL-encoded special characters in legitimate application traffic inspected by FortiWeb
  • Security scanners generating command injection test payloads
  • FortiWeb diagnostic or debug commands logged during maintenance windows

Other platforms for CVE-2025-58034

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1FortiWeb Command Injection via URI Path Semicolon Delimiter

    Expected signal: FortiWeb access logs showing HTTP GET request to /cgi-bin/module;id;whoami from test IP. CommonSecurityLog entry with RequestURL containing semicolons.

  2. Test 2FortiWeb Command Injection via URL-Encoded Shell Metacharacters

    Expected signal: FortiWeb logs showing request URL containing %3B sequence. Network proxy or WAF logs showing URL-decoded form with semicolons.

  3. Test 3Simulated Post-Exploitation Shell Spawn from Web Process

    Expected signal: Process execution log showing /bin/bash spawned with parent process www-data or httpsd equivalent. File creation event for /tmp/fortiweb_compromise_marker.txt.

  4. Test 4FortiWeb Management Interface Credential Stuffing and Command Injection Attempt

    Expected signal: FortiWeb authentication log showing POST to management API with injection payload in password field. CommonSecurityLog DeviceAction showing authentication attempt with anomalous credential content.

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the source IP and determine whether it belongs to a known administrator, security scanner, or external threat actor. Cross-reference with threat intelligence feeds and IP reputation services.
  2. Examine the raw HTTP request payload in FortiWeb logs for the specific URI path, query string, POST body, or HTTP header containing the injected shell metacharacters (e.g., `;`, `&&`, `|`, backtick, `$(`).
  3. Determine whether the injection attempt succeeded by correlating FortiWeb application logs with OS-level process execution logs: look for unexpected child processes spawned by httpsd or wad daemon (e.g., /bin/sh, /bin/bash, wget, curl, nc).
  4. Check FortiWeb system integrity indicators: look for new cron jobs, unauthorized user accounts, modified configuration files, or unexpected outbound network connections from the FortiWeb management IP.

Containment

  1. Immediately isolate the affected FortiWeb appliance from the network by disabling management access ACLs or placing it behind an emergency firewall rule blocking all inbound connections to management ports (80, 443, 8080, 8443) from unauthorized sources.
  2. Revoke all active administrative sessions on the FortiWeb appliance and rotate all credentials (admin passwords, API keys, certificates) stored on or associated with the device. Notify downstream systems that use FortiWeb for authentication or inspection.

Evidence Collection

  1. Capture and preserve full FortiWeb system logs (/var/log/), application logs, and traffic logs before any remediation. Export to a forensically sound, write-protected storage location with cryptographic hash verification.
  2. Collect a memory dump and disk image of the FortiWeb appliance if physically or virtually accessible, to preserve volatile artifacts such as injected command history, modified in-memory configurations, and active network connections (netstat -antp output).

Escalation Criteria

  • !Escalate immediately to incident response if any successful OS command execution is confirmed (e.g., child shell process observed, unauthorized file creation, outbound C2 connection from FortiWeb IP), as this represents full appliance compromise.
  • !Escalate if the FortiWeb appliance has access to internal network segments, as a compromised WAF is a high-value pivot point for lateral movement into protected application tiers, databases, or internal administrative networks.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >FortiWeb access logs showing HTTP requests with shell metacharacters (;, &&, |, `, $()) in URI paths, query strings, or POST bodies
  • >OS process execution logs on FortiWeb showing /bin/sh or /bin/bash spawned as children of httpsd or wad
  • >Crontab entries (/var/spool/cron/crontabs/, /etc/cron.d/) added after the exploitation timestamp
  • >New or modified files in /tmp, /var/tmp, or FortiWeb configuration directories created during the attack window
  • >Outbound network connections from the FortiWeb management IP to external IPs not in the approved management network

Tuning Guidance

Start with a 7-day baseline of FortiWeb log volume and establish allowlists for known management IP ranges and authorized scanner IPs. Tune the URL pattern matching to exclude legitimate application paths that use semicolons or pipes in query parameters by adding `not (RequestURL startswith "/api/allowed-path")` clauses. If false positive rates remain high from security scanners, add a suppression rule for known scanner user-agent strings. Increase confidence to 'high' once you have confirmed the FortiWeb version is within the affected range and have correlated network-layer detections with process-level telemetry showing shell spawning.

Hunting Queries

Threat hunting query for historical FortiWeb log review spanning 30 days, looking for HTTP requests containing OS command interpreter invocations or download utility references that may indicate successful exploitation or post-exploitation activity.

Hunting — KQL
kql 
CommonSecurityLog
| where DeviceVendor =~ "Fortinet" and DeviceProduct =~ "FortiWeb"
| where TimeGenerated > ago(30d)
| where RequestURL has_any ("/bin/sh", "/bin/bash", "wget", "curl ", "nc ", "ncat", "python -c", "perl -e")
    or AdditionalExtensions has "process_name=/bin/"
| summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)
| where count_ > 3
| sort by count_ desc
Hunting — SPL
spl 
index=network sourcetype=fortinet:fortiweb earliest=-30d
| where match(uri_path, "(?i)(\/bin\/sh|\/bin\/bash|wget |curl |netcat|nc |python -c|perl -e)")
   OR match(msg, "(?i)(os.command|shell.exec|execve|\/bin\/sh)")
| stats count by src_ip, uri_path, msg
| where count > 2
| sort - count

Atomic Red Team Tests

Test 1 FortiWeb Command Injection via URI Path Semicolon Delimiter
linux

Simulates an OS command injection attempt against a FortiWeb management or inspection endpoint by injecting a semicolon-delimited shell command into the URI path. Lab use only.

Command

bash 
curl -sk 'https://TARGET_FORTIWEB_IP/cgi-bin/module;id;whoami' -H 'User-Agent: Mozilla/5.0' --max-time 10 -o /tmp/fortiweb_test_output.txt && cat /tmp/fortiweb_test_output.txt

Cleanup

bash 
rm -f /tmp/fortiweb_test_output.txt

Expected Telemetry

FortiWeb access logs showing HTTP GET request to /cgi-bin/module;id;whoami from test IP. CommonSecurityLog entry with RequestURL containing semicolons.

Expected Detection

KQL and SPL queries matching on RequestURL containing ';' pattern from non-admin source IP

Test 2 FortiWeb Command Injection via URL-Encoded Shell Metacharacters
linux

Tests detection of URL-encoded OS command injection payload (%3B = ';', %7C = '|') that may bypass simple string matching but should be caught by URL-decode-aware detections.

Command

bash 
curl -sk 'https://TARGET_FORTIWEB_IP/api/v1/config%3Bid%3Bwhoami' -H 'Content-Type: application/json' --max-time 10 -v 2>&1 | tee /tmp/fortiweb_encoded_test.txt

Cleanup

bash 
rm -f /tmp/fortiweb_encoded_test.txt

Expected Telemetry

FortiWeb logs showing request URL containing %3B sequence. Network proxy or WAF logs showing URL-decoded form with semicolons.

Expected Detection

Queries matching on URL-encoded metacharacter patterns (%3B, %7C, %26%26) in RequestURL or uri_path fields

Test 3 Simulated Post-Exploitation Shell Spawn from Web Process
linux

On a test Linux host representing a compromised FortiWeb, simulates an attacker spawning a shell from a web server process to validate process-lineage detections.

Command

bash 
sudo -u www-data /bin/bash -c 'id && whoami && hostname && cat /etc/passwd | head -5 && echo CVE-2025-58034-test > /tmp/fortiweb_compromise_marker.txt'

Cleanup

bash 
rm -f /tmp/fortiweb_compromise_marker.txt

Expected Telemetry

Process execution log showing /bin/bash spawned with parent process www-data or httpsd equivalent. File creation event for /tmp/fortiweb_compromise_marker.txt.

Expected Detection

Elastic EQL sequence detection correlating web process parent with /bin/bash child spawn. CrowdStrike ProcessRollup2 event showing shell child of web daemon.

Test 4 FortiWeb Management Interface Credential Stuffing and Command Injection Attempt
linux

Simulates an attacker attempting to authenticate and inject commands via FortiWeb's management API endpoint, combining credential abuse with command injection payload.

Command

bash 
curl -sk -X POST 'https://TARGET_FORTIWEB_IP/api/v2.0/cmdb/system/admin' -H 'Content-Type: application/json' -d '{"username":"admin","password":"admin$(id)"}' --max-time 10 -o /tmp/fortiweb_api_test.txt 2>&1; cat /tmp/fortiweb_api_test.txt

Cleanup

bash 
rm -f /tmp/fortiweb_api_test.txt

Expected Telemetry

FortiWeb authentication log showing POST to management API with injection payload in password field. CommonSecurityLog DeviceAction showing authentication attempt with anomalous credential content.

Expected Detection

Detections matching on POST body containing $() subshell syntax or shell metacharacters in authentication fields

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix ShellT1053.003Cron

Same Tactic: Initial Access

Popular Detections