Detect CVE-2025-64446: Fortinet FortiWeb Path Traversal Exploitation in CrowdStrike LogScale
Detects exploitation attempts targeting CVE-2025-64446, a path traversal vulnerability (CWE-23) in Fortinet FortiWeb. This vulnerability allows attackers to traverse directory boundaries and access files outside the intended web root, potentially exposing sensitive configuration files, credentials, or system files. The vulnerability is listed in CISA KEV indicating active exploitation in the wild.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=NetworkReceiveAcceptIPv4 OR #event_simpleName=NetworkReceiveAcceptIPv6 OR #event_simpleName=HttpRequest
| LocalPort = 443 OR LocalPort = 80 OR LocalPort = 8080 OR LocalPort = 8443
| HttpUri = /(\.\.%2[Ff]|%2[Ee]%2[Ee]%2[Ff]|%2[Ee]%2[Ee]\/|\.\.\\|%252[Ee]%252[Ee]|\.\.%252[Ff]|\.\.\.\.\/)/
OR HttpUri = /(etc\/passwd|etc\/shadow|web\.config|\.\.\/\.\.\/|\.\.\\\.\.\\/)/i
| groupby([RemoteAddressIP4, RemoteAddressIP4, HttpUri, LocalAddressIP4], function=count(1, as=request_count))
| request_count >= 1
| sort(request_count, order=desc)CrowdStrike Falcon CQL detection for path traversal activity including HTTP requests with traversal sequences. Primarily useful for detecting traversal attempts from hosts running the Falcon sensor that communicate with or forward to FortiWeb.
Data Sources
Required Tables
False Positives & Tuning
- Security testing tools running on monitored endpoints performing authorized scans
- URL encoding by legitimate browser or application clients creating apparent traversal patterns
- Automated deployment tools using path-based APIs that resemble traversal sequences
- Vulnerability scanner endpoints registered in the environment performing scheduled assessments
Other platforms for CVE-2025-64446
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic Path Traversal Against FortiWeb-Protected Endpoint
Expected signal: FortiWeb access log entry with the traversal URL, source IP, HTTP method GET, and either a 403 block response (if WAF in block mode) or 200/redirect if in monitor mode. SIEM should receive a CommonSecurityLog or syslog event within 60 seconds.
- Test 2URL-Encoded Path Traversal (Double Encoding)
Expected signal: Multiple FortiWeb log entries with percent-encoded URL paths. SIEM events should show the encoded traversal sequences in RequestURL or Message fields. Attack log should show WAF signature matches for each encoded variant.
- Test 3Traversal Targeting FortiWeb Configuration or Certificate Files
Expected signal: FortiWeb access and attack logs showing four separate requests targeting sensitive paths. Response codes expected to be 403 if blocking mode is active. SIEM should receive all four events and score the requests with TargetsSensitiveFile=true, raising FinalScore to critical threshold.
- Test 4Automated Traversal Fuzzing Simulation
Expected signal: Burst of 8 FortiWeb log events from the same source IP within 10 seconds, each containing traversal patterns. SIEM correlation rules should group these by source IP and escalate based on repeat attempts.
Response Playbook
Triage
- Identify the source IP and confirm it is external or an unexpected internal host — check whether it corresponds to a known authorized scanner, penetration tester, or threat actor by cross-referencing threat intelligence feeds and IP reputation databases.
- Review the full request URL and HTTP response code in FortiWeb logs to determine whether the traversal attempt was blocked by the WAF policy or succeeded (HTTP 200 with non-trivial response body size suggests success).
- Determine which path was targeted: if the traversal targeted /etc/passwd, /etc/shadow, SSL certificates, FortiWeb configuration files, or application credentials, treat as confirmed high-severity incident requiring immediate escalation.
- Check FortiWeb WAF policy enforcement mode — if the device was in detection-only or monitor mode rather than blocking mode, the attack may have passed through to the backend application.
- Correlate source IP activity across all network logs for the same time window to identify lateral movement, data exfiltration, or follow-on exploitation attempts (e.g., credential use, reverse shell callbacks).
Containment
- If exploitation is confirmed or the FortiWeb WAF was in monitor mode, immediately block the source IP at the perimeter firewall and on the FortiWeb access control policy, and isolate the FortiWeb appliance management interface from untrusted networks.
- Apply the Fortinet-issued patch for CVE-2025-64446 immediately — reference FG-IR-25-910 for the patch package — and if patching cannot occur immediately, configure a virtual patch rule in FortiWeb to block requests containing traversal sequences targeting sensitive paths.
- Rotate all credentials and secrets accessible from the FortiWeb appliance file system, including SSL private keys, API tokens, LDAP bind credentials, and any application credentials stored in FortiWeb configuration files.
Evidence Collection
- Capture and preserve full FortiWeb access and attack logs for the affected time window, including raw syslog exports, before any log rotation occurs. Archive to tamper-evident storage.
- Collect FortiWeb configuration snapshots, including virtual server definitions, WAF policies, and server pool configurations, to establish what backend applications and paths were potentially exposed.
- If the FortiWeb appliance is accessible for forensic investigation, collect running process list, network connection state, authentication logs, and any files with recent modification timestamps in web-accessible directories.
Escalation Criteria
- !Escalate immediately to incident response if any traversal request returned HTTP 200 with a response body size consistent with the targeted file (e.g., /etc/passwd typically 1-4 KB), indicating successful file disclosure.
- !Escalate if post-exploitation activity is observed from the same source IP, including authentication attempts using credentials that may have been disclosed, outbound connections to C2 infrastructure, or lateral movement within the network segment.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
FortiWeb access logs containing raw HTTP request URLs with traversal sequences, response codes, and response sizes - >
FortiWeb attack logs with WAF policy match records, block/allow action, and attack signature IDs - >
Network packet captures (PCAP) on the FortiWeb management or traffic interface capturing the full HTTP request and response payload - >
FortiWeb configuration backup files to identify what credentials and certificates were potentially exposed - >
System file modification timestamps on FortiWeb for any files in web-accessible paths that changed during or after the attack window
Tuning Guidance
Start with high-confidence tuning by adding known authorized scanner IP ranges (Qualys, Tenable, Rapid7 cloud scanner CIDRs) to an allowlist exclusion. If the environment uses legitimate URL rewriting that produces traversal-like sequences, capture those specific patterns and exclude them by exact match. Adjust the traversal depth threshold (default 1) upward to 2 or 3 in environments where single-depth traversal generates excessive false positives from proxies or CDNs. For SPL and KQL, create a lookup table of approved pentest source IPs that can be excluded during authorized engagement windows. Monitor the ratio of blocked to allowed traversal attempts in FortiWeb WAF logs — if the WAF is blocking all attempts, consider reducing alert severity to medium for blocked events while maintaining critical for any allowed traversal responses.
Hunting Queries
7-day retrospective hunt for source IPs conducting repeated path traversal attempts against FortiWeb, identifying potential reconnaissance or persistent exploitation campaigns that may have predated the detection rule deployment.
CommonSecurityLog
| where DeviceVendor == "Fortinet" and DeviceProduct == "FortiWeb"
| where TimeGenerated >= ago(7d)
| extend NormalizedURL = tolower(coalesce(RequestURL, ""))
| where NormalizedURL matches regex @"(\.\./|\.\.%2f|%2e%2e%2f|%2e%2e%5c|%252e%252e)"
| summarize TotalAttempts = count(), UniqueURLs = dcount(RequestURL), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP
| where TotalAttempts >= 2
| order by TotalAttempts descindex=fortinet sourcetype=fortinet:fortiWeb earliest=-7d
| eval url=lower(coalesce(url, request_url, uri, ""))
| where match(url, "(\.\./|\.\.\\/|%2e%2e%2f|%2e%2e/|\.\.%2f|%2e%2e%5c|%252e%252e)")
| stats count as attempt_count, dc(url) as unique_paths, min(_time) as first_seen, max(_time) as last_seen by src_ip
| where attempt_count >= 2
| sort -attempt_count30-day hunt for requests specifically targeting sensitive file paths regardless of traversal sequence encoding, catching attackers who may use alternative encoding or exploit secondary vulnerabilities to reach sensitive files.
CommonSecurityLog
| where DeviceVendor == "Fortinet" and DeviceProduct == "FortiWeb"
| where TimeGenerated >= ago(30d)
| extend NormalizedURL = tolower(coalesce(RequestURL, ""))
| where NormalizedURL has_any (['/etc/passwd', '/etc/shadow', 'web.config', 'config.json', 'ssl/private', '.key', 'certificate'])
| project TimeGenerated, SourceIP, RequestURL, DeviceAction
| order by TimeGenerated descindex=fortinet sourcetype=fortinet:fortiWeb earliest=-30d
| eval url=lower(coalesce(url, request_url, uri, ""))
| where match(url, "(etc/passwd|etc/shadow|web\.config|\.key$|ssl/private|certificate)")
| table _time, src_ip, url, action
| sort -_timeAtomic Red Team Tests
Simulates a basic path traversal attack targeting /etc/passwd via a FortiWeb WAF. Tests whether the WAF detection signatures and SIEM logging pipeline correctly capture and alert on the traversal attempt.
Command
curl -v -k 'https://<FORTIWEB_IP>/protected-app/../../../../etc/passwd' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36' --connect-timeout 10 2>&1 | grep -E '(HTTP|Location|< |passwd)'Cleanup
No cleanup required — this is a read-only HTTP request. Review FortiWeb logs to confirm detection and clear any temporary firewall blocks on the test source IP if needed.Expected Telemetry
FortiWeb access log entry with the traversal URL, source IP, HTTP method GET, and either a 403 block response (if WAF in block mode) or 200/redirect if in monitor mode. SIEM should receive a CommonSecurityLog or syslog event within 60 seconds.
Expected Detection
Alert triggered by KQL/SPL detection rules matching the '../' traversal pattern in the RequestURL field with FinalScore >= 50.
Tests detection of percent-encoded path traversal variants (%2e%2e%2f and %252e%252e%252f) that may bypass naive signature matching. Validates that detection rules cover encoded traversal sequences.
Command
for PAYLOAD in '%2e%2e%2f%2e%2e%2fetc%2fpasswd' '%252e%252e%252f%252e%252e%252fetc%252fpasswd' '..%2f..%2fetc%2fpasswd' '%2e%2e/%2e%2e/etc/passwd'; do echo "Testing: $PAYLOAD"; curl -s -o /dev/null -w "%{http_code} %{url_effective}" -k "https://<FORTIWEB_IP>/app/$PAYLOAD" --connect-timeout 5; echo; sleep 2; doneCleanup
No persistent changes. If source IP was blocked by FortiWeb during the test, remove from block list in FortiWeb policy management after confirming detection worked.Expected Telemetry
Multiple FortiWeb log entries with percent-encoded URL paths. SIEM events should show the encoded traversal sequences in RequestURL or Message fields. Attack log should show WAF signature matches for each encoded variant.
Expected Detection
Detection rules using regex patterns for %2e%2e%2f, %252e%252e, and ..%2f should trigger separate alerts or a single aggregated alert for the source IP within the session window.
Simulates high-impact exploitation by targeting FortiWeb-specific sensitive paths including SSL certificate directories and configuration files. This represents the worst-case exploitation objective of CVE-2025-64446.
Command
for TARGET in '../../../etc/ssl/private/fortiweb.key' '../../../etc/fortiWeb/config' '../../../../proc/self/environ' '../../../var/log/fortiWeb/access.log'; do echo "[*] Targeting: $TARGET"; curl -s -o /dev/null -w "%{http_code}" -k "https://<FORTIWEB_IP>/app/$TARGET" --connect-timeout 5; echo " - done"; sleep 3; doneCleanup
No persistent changes made. Review FortiWeb attack logs post-test to confirm all four requests were logged. Unblock test source IP if auto-blocked.Expected Telemetry
FortiWeb access and attack logs showing four separate requests targeting sensitive paths. Response codes expected to be 403 if blocking mode is active. SIEM should receive all four events and score the requests with TargetsSensitiveFile=true, raising FinalScore to critical threshold.
Expected Detection
High-confidence alert with TargetsSensitiveFile flag set to true, FinalScore >= 70, triggering escalation to critical severity in the SIEM and playbook escalation workflow.
Simulates an attacker using automated tooling to fuzz path traversal depth and encoding variations at speed, mimicking tools like dotdotpwn or similar path traversal fuzzers that are commonly used in exploitation of CVE-2025-64446.
Command
python3 -c "
import urllib.request, ssl, time
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
payloads = ['../etc/passwd', '../../etc/passwd', '../../../etc/passwd', '....//etc/passwd', '..%2fetc%2fpasswd', '%2e%2e/etc/passwd', '%2e%2e%2fetc%2fpasswd', '..%252fetc%252fpasswd']
for p in payloads:
try:
url = f'https://<FORTIWEB_IP>/app/{p}'
req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
r = urllib.request.urlopen(req, context=ctx, timeout=5)
print(f'{r.status} {p}')
except Exception as e:
print(f'ERR {p}: {type(e).__name__}')
time.sleep(1)
"Cleanup
No persistent changes. The test generates 8 HTTP requests over approximately 8 seconds. Clear any source IP blocks from FortiWeb after confirming detection. Review SIEM to confirm burst detection logic (if implemented) triggered.Expected Telemetry
Burst of 8 FortiWeb log events from the same source IP within 10 seconds, each containing traversal patterns. SIEM correlation rules should group these by source IP and escalate based on repeat attempts.
Expected Detection
Multiple rule matches from a single source IP within a short timeframe. Sumo Logic count aggregation and QRadar sequence correlation should surface this as a high-confidence exploitation attempt rather than a single accidental request.