how is this even possible?

Quick Overview

A critical vulnerability (CVE-2025-52970) in Fortinet's FortiWeb Web Application Firewall allows attackers to bypass authentication and achieve remote code execution by manipulating session cookies via an out-of-bounds read vulnerability in the 'Era' parameter.

Key Points: The vulnerability, CVE-2025-52970, resides in Fortinet's FortiWeb Web Application Firewall and allows for authentication bypass and remote code execution. Attackers can exploit this by sending a crafted cookie with an out-of-bounds read in the 'Era' parameter, which is not properly validated. This out-of-bounds read allows attackers to read sensitive data from memory, specifically revealing the key used for session encryption/signing. By knowing this key, attackers can then forge their own session cookies, effectively impersonating any user, including administrators. The vulnerability was discovered by researcher 'waitis' and has a proof-of-concept demonstrating administrative access via a REST endpoint. Fortinet has released patches for this vulnerability, urging users to update their FortiWeb appliances immediately to mitigate the risk. The exploit involves manipulating the 'Era' parameter in the session cookie to trigger the out-of-bounds read, leading to key leakage and subsequent cookie forging.

Context: The video discusses a critical cybersecurity vulnerability found in Fortinet's FortiWeb Web Application Firewall. This vulnerability, identified as CVE-2025-52970, allows an attacker to bypass authentication mechanisms and execute arbitrary code on the targeted device. The exploit involves crafting a malicious session cookie that targets an 'Era' parameter, which is improperly validated, leading to an out-of-bounds read vulnerability. This read allows the attacker to discover the secret key used for session encryption, enabling them to forge valid session cookies and gain unauthorized access.

Detailed Analysis

The video details a critical vulnerability (CVE-2025-52970) in Fortinet's FortiWeb Web Application Firewall that permits authentication bypass and remote code execution (RCE). The vulnerability stems from an out-of-bounds read in the 'Era' parameter within the session cookie. When FortiWeb processes a crafted cookie with an 'Era' value outside the expected range (0 or 1), it reads uninitialized memory, potentially exposing the secret key used for session encryption and HMAC signing. This key allows attackers to forge valid session cookies, impersonating any user, including administrators, and gain administrative access to the FortiWeb appliance. The researcher 'waitis' discovered this flaw and provided a proof-of-concept demonstrating how to exploit it via a REST endpoint to obtain system status information, effectively showcasing the ability to bypass authentication and gain unauthorized access. Fortinet has acknowledged the vulnerability and released patches, urging all administrators to update their FortiWeb systems promptly to protect against potential exploitation.