CVE-2025-61624 Microsoft Sentinel · KQL

Detect Fortinet Multiple Products Path Traversal (CVE-2025-61624) in Microsoft Sentinel

Detects exploitation attempts against CVE-2025-61624, a path traversal (CWE-22) vulnerability affecting multiple Fortinet products (including FortiOS management surfaces). Attackers leverage directory traversal sequences in HTTP request paths/parameters to read sensitive files (e.g. configuration, credential stores, session data) or access resources outside the intended web root on exposed Fortinet appliances. This vulnerability is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on traversal patterns, encoded traversal sequences, and anomalous access to sensitive paths against Fortinet management interfaces.

MITRE ATT&CK

Tactic
Initial Access Collection

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let traversalPatterns = dynamic(["../", "..%2f", "%2e%2e%2f", "..%5c", "%2e%2e/", "....//", "%252e%252e%252f", "..\\"]);
let fortiUserAgents = dynamic([""]);
CommonSecurityLog
| where DeviceVendor =~ "Fortinet"
| where RequestURL has_any (traversalPatterns) or RequestURL has_any ("/etc/passwd", "sslvpn_websession", "/config/", "system_global")
| extend DecodedUrl = url_decode(RequestURL)
| where DecodedUrl contains "../" or DecodedUrl contains "..\\"
| project TimeGenerated, SourceIP, DestinationIP, DeviceName, RequestURL, DecodedUrl, RequestMethod, DeviceAction, ApplicationProtocol
| sort by TimeGenerated desc
high severity medium confidence

Flags HTTP requests to Fortinet devices containing path traversal sequences (raw or URL-encoded) or access to sensitive file paths, consistent with CVE-2025-61624 exploitation.

Data Sources

Fortinet FortiGate/FortiOS syslog (CEF)Network Firewall logsWeb proxy logs

Required Tables

CommonSecurityLog

False Positives & Tuning

  • Legitimate vulnerability scanners (Qualys, Tenable, Rapid7) probing the appliance
  • Security team authorized penetration testing of Fortinet management interface
  • Malformed but benign client requests with relative path artifacts in URLs

Other platforms for CVE-2025-61624

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Basic path traversal probe against Fortinet web interface

    Expected signal: Fortinet traffic/event log entry recording an HTTP request with an encoded traversal path to /etc/passwd.

  2. Test 2 URL-encoded traversal to session file

    Expected signal: Fortinet log entry with double-encoded traversal and sslvpn_websession reference in the URL.

  3. Test 3 Backslash traversal probe (Windows-style separators)

    Expected signal: Fortinet log entry recording an HTTP request with ..%5c backslash traversal targeting /config.

Last updated: 2026-10-17 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the source IP and whether it is internal, a known scanner, or an untrusted external host; enrich with threat intel and geolocation.
  2. Extract and URL-decode the full request path to determine the exact file or resource targeted by the traversal (e.g. config, sslvpn_websession, credential stores).
  3. Check the Fortinet device response code and byte count to determine whether the traversal succeeded (HTTP 200 with large payload) versus was blocked (403/404).
  4. Verify the affected appliance's firmware version against the FG-IR-26-122 advisory to confirm it is in the vulnerable range.

Containment

  1. Block the offending source IP(s) at the perimeter and on the Fortinet device's local-in policy.
  2. Restrict administrative/management interface exposure to the public internet; move management to a trusted VPN or management VLAN.
  3. Apply the Fortinet FG-IR-26-122 patch or vendor workaround on all affected appliances as an emergency change.

Evidence Collection

  1. Preserve full Fortinet appliance logs (traffic, event, and admin logs) and any available HTTP request/response captures around the alert window.
  2. Export the device configuration backup and session/credential tables to assess what may have been exfiltrated via the traversal.

Escalation Criteria

  • !Escalate to incident response if response telemetry indicates successful retrieval of configuration, credential, or VPN session files.
  • !Escalate immediately if the same source subsequently authenticates or establishes a VPN session, indicating credential theft from the traversal.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Fortinet device traffic and event logs showing the traversal request and HTTP response size/code.
  • >Device configuration backups and sslvpn_websession artifacts indicating accessed resources.
  • >Admin and VPN authentication logs for follow-on access from the same source.

Tuning Guidance

Allowlist known internal vulnerability scanners and authorized pentest source IPs to reduce noise. Tune the sensitive-path list (sslvpn_websession, /config/, /etc/passwd) to your appliance type and expose only the traversal+response-success combination for high-fidelity alerting. If decoding at ingest is unavailable, lower the repeated-request threshold to catch encoded-only probes.

Hunting Queries

Hunt for source IPs issuing repeated path traversal requests against any Fortinet device, surfacing automated scanning or exploitation campaigns.

Hunting — KQL
kql 
CommonSecurityLog | where DeviceVendor =~ "Fortinet" | extend d = url_decode(RequestURL) | where d has "../" or d has "..\\" | summarize count(), make_set(RequestURL) by SourceIP, DeviceName | where count_ > 5
Hunting — SPL
spl 
index=fortinet | eval d=urldecode(coalesce(url,request,uri)) | where match(d,"\.\.[\/\\]") | stats count values(url) as urls by src_ip host | where count>5

Atomic Red Team Tests

Test 1 Basic path traversal probe against Fortinet web interface
linux

Sends an HTTP request with a classic ../ traversal sequence targeting a sensitive file to simulate CVE-2025-61624 probing.

Command

bash 
curl -k -s -o /dev/null -w '%{http_code}\n' 'https://FORTI_HOST/..%2f..%2f..%2f..%2fetc%2fpasswd'

Cleanup

bash 
echo 'No cleanup required; read-only request'

Expected Telemetry

Fortinet traffic/event log entry recording an HTTP request with an encoded traversal path to /etc/passwd.

Expected Detection

KQL/SPL rule fires on the decoded ../ sequence and sensitive path /etc/passwd.

Test 2 URL-encoded traversal to session file
linux

Simulates attempts to read sslvpn_websession via double-encoded traversal sequences.

Command

bash 
curl -k -s 'https://FORTI_HOST/%252e%252e%252f%252e%252e%252fsslvpn_websession'

Cleanup

bash 
echo 'No cleanup required'

Expected Telemetry

Fortinet log entry with double-encoded traversal and sslvpn_websession reference in the URL.

Expected Detection

Detection matches the %2e%2e / sslvpn_websession patterns after decoding.

Test 3 Backslash traversal probe (Windows-style separators)
windows

Sends traversal using backslash separators to test alternate encoding handling of CVE-2025-61624 detection.

Command

powershell 
powershell -c "Invoke-WebRequest -Uri 'https://FORTI_HOST/..%5c..%5c..%5cconfig' -SkipCertificateCheck -UseBasicParsing"

Cleanup

powershell 
Remove-Item Env:\NONE -ErrorAction SilentlyContinue

Expected Telemetry

Fortinet log entry recording an HTTP request with ..%5c backslash traversal targeting /config.

Expected Detection

Rule fires on the ..%5c encoded backslash traversal and /config path.

Related Detections

Tactic Hubs

TA0001 Initial Access TA0009 Collection

Related Techniques

T1190 Exploit Public-Facing Application T1083 File and Directory Discovery T1552.001 Credentials In Files

Same Tactic: Initial Access

Popular Detections