Fortinet Multiple Products Improper Verification of Cryptographic Signature (CVE-2025-59718)

let FortinetManagementIPs = dynamic([]);
let SuspiciousFirmwareKeywords = dynamic(['unsigned', 'signature', 'bypass', 'invalid cert', 'certificate error', 'verification failed', 'sig check']);
union 
    (
        CommonSecurityLog
        | where DeviceVendor =~ "Fortinet"
        | where DeviceEventClassID has_any ("update", "firmware", "upgrade", "install")
        | where Message has_any (SuspiciousFirmwareKeywords)
        | extend EventType = "FirmwareUpdateAnomaly"
    ),
    (
        Syslog
        | where ProcessName has_any ("fortigate", "fortios", "fortid", "fgd", "fnbamd")
        | where SyslogMessage has_any (SuspiciousFirmwareKeywords)
        | extend EventType = "SyslogSignatureBypass"
    ),
    (
        AzureNetworkAnalytics_CL
        | where SrcIP_s in (FortinetManagementIPs) or DestIP_s in (FortinetManagementIPs)
        | where L7Protocol_s in~ ("https", "http")
        | where DestPort_d in (80, 443, 8443)
        | where FlowStatus_s !~ "Allowed"
        | extend EventType = "FortinetNetworkAnomaly"
    )
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by EventType, Computer, SourceIP=coalesce(SourceIP, SrcIP_s), DeviceVendor
| where Count > 1
| extend AlertSeverity = "High"
| project-reorder LastSeen, EventType, Computer, SourceIP, Count, AlertSeverity

index=network OR index=security sourcetype IN ("fortigate_log", "fortinet:fortigate:firewall", "fortinet:syslog", "syslog")
(vendor="Fortinet" OR source="fortigate" OR host IN (fortinet_hosts))
(
  (message IN ("*signature*bypass*", "*invalid signature*", "*cert*verification*failed*", "*unsigned firmware*", "*signature check failed*"))
  OR (subtype="update" message="*error*")
  OR (type="event" subtype="system" action="upgrade" status!="success")
)
| eval risk_score=case(
    match(message, "(?i)bypass"), 90,
    match(message, "(?i)unsigned"), 85,
    match(message, "(?i)signature.*fail"), 80,
    true(), 60
  )
| eval event_category=case(
    match(subtype, "update|upgrade|firmware"), "firmware_update",
    match(message, "(?i)cert"), "certificate_validation",
    true(), "signature_verification"
  )
| stats count AS event_count, min(_time) AS first_seen, max(_time) AS last_seen, values(message) AS messages, max(risk_score) AS max_risk by host, src_ip, event_category
| where event_count > 0
| eval severity=if(max_risk >= 80, "critical", "high")
| sort -max_risk

sequence by host.name with maxspan=10m
  [any where event.dataset == "fortinet.firewall"
    and (
      message like~ "*signature*fail*"
      or message like~ "*unsigned*firmware*"
      or message like~ "*cert*verif*fail*"
      or message like~ "*bypass*sig*"
    )
  ] by host.name
  [any where event.dataset == "fortinet.firewall"
    and (
      event.action in ("upgrade", "firmware-install", "update")
      or fortinet.firewall.subtype in ("update", "upgrade")
    )
  ] by host.name

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  devicevendor,
  deviceproduct,
  QIDNAME(qid) AS event_name,
  UTF8(payload) AS raw_payload,
  logsourcename(logSourceId) AS log_source
FROM events
WHERE
  devicevendor ILIKE '%fortinet%'
  AND (
    UTF8(payload) ILIKE '%signature%fail%'
    OR UTF8(payload) ILIKE '%unsigned firmware%'
    OR UTF8(payload) ILIKE '%cert%verif%fail%'
    OR UTF8(payload) ILIKE '%bypass%signature%'
    OR (QIDNAME(qid) ILIKE '%firmware%' AND UTF8(payload) ILIKE '%error%')
    OR (QIDNAME(qid) ILIKE '%update%' AND UTF8(payload) ILIKE '%invalid%')
  )
  AND LOGSOURCETYPENAME(devicetype) IN ('Fortinet FortiGate', 'Fortinet FortiManager', 'Fortinet FortiAnalyzer', 'Syslog')
LAST 24 HOURS
ORDER BY devicetime DESC

_sourceCategory=network/fortinet OR _sourceCategory=security/fortigate
| where vendor = "Fortinet" or _sourceName matches "*fortigate*" or _sourceName matches "*fortios*"
| where (
    message matches "*signature*fail*"
    or message matches "*unsigned firmware*"
    or message matches "*certificate verification failed*"
    or message matches "*bypass*sig*"
    or (subtype = "update" and status != "success")
  )
| parse field=message "type=* subtype=* level=* vd=* eventtime=* logdesc=*" as event_type, event_subtype, log_level, vdom, event_time, log_desc nodrop
| if (message matches "*bypass*", 90, if (message matches "*unsigned*", 85, if (message matches "*signature*fail*", 80, 60))) as risk_score
| count by _sourceHost, _collector, event_type, event_subtype, log_desc, risk_score
| sort by risk_score desc

rule cve_2025_59718_fortinet_signature_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-59718 Fortinet cryptographic signature verification bypass"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://fortiguard.fortinet.com/psirt/FG-IR-25-647"
    cve = "CVE-2025-59718"

  events:
    (
      $e.metadata.vendor_name = "Fortinet" nocase
      or $e.target.application = /fortigate/i
      or $e.target.application = /fortios/i
      or $e.target.application = /fortimanager/i
    )
    and (
      $e.metadata.description = /signature.*fail/i
      or $e.metadata.description = /unsigned.*firmware/i
      or $e.metadata.description = /cert.*verif.*fail/i
      or $e.metadata.description = /bypass.*sig/i
      or (
        $e.metadata.event_type = "NETWORK_HTTP"
        and $e.network.http.response_code >= 400
        and (
          $e.target.url = /\/api\/v2\/monitor\/system\/firmware/
          or $e.target.url = /\/api\/v2\/cmdb\/system\/auto-update/
        )
      )
    )

  condition:
    $e
}

#event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6", "ProcessRollup2", "SyntheticProcessRollup2")
| ProductType = "Fortinet"
  OR FileName IN ("fortigate", "fortid", "fnbamd", "fgfmd", "forticlid")
  OR CommandLine CONTAINS "signature"
  OR CommandLine CONTAINS "firmware"
| CommandLine MATCHES "(?i)(bypass.*sig|unsigned.*firm|cert.*verif.*fail|sig.*check.*fail|invalid.*signature)"
| groupBy([ComputerName, UserName, FileName, CommandLine], function=[
    count(aid, as=EventCount),
    min(timestamp, as=FirstSeen),
    max(timestamp, as=LastSeen)
  ])
| EventCount > 0
| sort(LastSeen, order=desc)
| select([ComputerName, UserName, FileName, CommandLine, EventCount, FirstSeen, LastSeen])