# how is this even possible?

Source: https://www.youtube.com/watch?v=JNW5fHJ-Nyo
Recap page: https://rapidrecap.app/video/JNW5fHJ-Nyo
Generated: 2025-08-26T15:32:42.464+00:00

---
## Quick Overview

A critical vulnerability (CVE-2025-52970) in Fortinet's FortiWeb Web Application Firewall allows attackers to bypass authentication and achieve remote code execution by manipulating session cookies via an out-of-bounds read vulnerability in the 'Era' parameter.

**Key Points:**
- The vulnerability, CVE-2025-52970, resides in Fortinet's FortiWeb Web Application Firewall and allows for authentication bypass and remote code execution.
- Attackers can exploit this by sending a crafted cookie with an out-of-bounds read in the 'Era' parameter, which is not properly validated.
- This out-of-bounds read allows attackers to read sensitive data from memory, specifically revealing the key used for session encryption/signing.
- By knowing this key, attackers can then forge their own session cookies, effectively impersonating any user, including administrators.
- The vulnerability was discovered by researcher 'waitis' and has a proof-of-concept demonstrating administrative access via a REST endpoint.
- Fortinet has released patches for this vulnerability, urging users to update their FortiWeb appliances immediately to mitigate the risk.
- The exploit involves manipulating the 'Era' parameter in the session cookie to trigger the out-of-bounds read, leading to key leakage and subsequent cookie forging.

![Screenshot at 00:00: The video opens with a Reddit post detailing the "Heads up if you admin FortiWeb \(CVE-2025-52970\)" vulnerability, highlighting an attacker attempting exploitation.](https://ss.rapidrecap.app/screens/JNW5fHJ-Nyo/00-00-00.png)

**Context:** The video discusses a critical cybersecurity vulnerability found in Fortinet's FortiWeb Web Application Firewall. This vulnerability, identified as CVE-2025-52970, allows an attacker to bypass authentication mechanisms and execute arbitrary code on the targeted device. The exploit involves crafting a malicious session cookie that targets an 'Era' parameter, which is improperly validated, leading to an out-of-bounds read vulnerability. This read allows the attacker to discover the secret key used for session encryption, enabling them to forge valid session cookies and gain unauthorized access.

## Detailed Analysis

The video details a critical vulnerability (CVE-2025-52970) in Fortinet's FortiWeb Web Application Firewall that permits authentication bypass and remote code execution (RCE). The vulnerability stems from an out-of-bounds read in the 'Era' parameter within the session cookie. When FortiWeb processes a crafted cookie with an 'Era' value outside the expected range (0 or 1), it reads uninitialized memory, potentially exposing the secret key used for session encryption and HMAC signing. This key allows attackers to forge valid session cookies, impersonating any user, including administrators, and gain administrative access to the FortiWeb appliance. The researcher 'waitis' discovered this flaw and provided a proof-of-concept demonstrating how to exploit it via a REST endpoint to obtain system status information, effectively showcasing the ability to bypass authentication and gain unauthorized access. Fortinet has acknowledged the vulnerability and released patches, urging all administrators to update their FortiWeb systems promptly to protect against potential exploitation.

### Vulnerability Overview

- CVE-2025-52970 allows authentication bypass and RCE in FortiWeb WAF

### Exploitation Method

- Out-of-bounds read in 'Era' parameter of session cookies

### Impact

- Discovery of secret key, enabling session cookie forgery and administrative impersonation

### Discovery

- Found by researcher 'waitis', with a PoC demonstrating administrative access

### Mitigation

- Fortinet has released patches and urges immediate updates

![Screenshot at 00:00: A Reddit post title announces the FortiWeb vulnerability \(CVE-2025-52970\) and warns administrators.](https://ss.rapidrecap.app/screens/JNW5fHJ-Nyo/00-00-00.png)
![Screenshot at 00:09: The video shows the Fortinet FortiWeb product page, introducing it as a Web Application Firewall.](https://ss.rapidrecap.app/screens/JNW5fHJ-Nyo/00-00-09.png)
![Screenshot at 00:34: A diagram illustrates how FortiWeb's machine learning analyzes application traffic, distinguishing between normal traffic, anomalies, and attacks.](https://ss.rapidrecap.app/screens/JNW5fHJ-Nyo/00-00-34.png)
![Screenshot at 01:00: The presenter highlights a specific request logged from a FortiWeb honeypot, showing a crafted cookie with unusual parameters.](https://ss.rapidrecap.app/screens/JNW5fHJ-Nyo/00-01-00.png)
![Screenshot at 01:11: A detailed view of the crafted cookie, showing the 'Era' parameter and other encoded data used in the exploit.](https://ss.rapidrecap.app/screens/JNW5fHJ-Nyo/00-01-11.png)
![Screenshot at 01:31: The video displays a blog post from pwner.gg detailing the vulnerability analysis, including the assigned CVE.](https://ss.rapidrecap.app/screens/JNW5fHJ-Nyo/00-01-31.png)
![Screenshot at 01:44: A Venn diagram shows how FortiWeb categorizes network traffic, with 'Attacks' falling within 'Anomalies' and 'Normal Application Traffic'.](https://ss.rapidrecap.app/screens/JNW5fHJ-Nyo/00-01-44.png)
![Screenshot at 02:02: An example of a session cookie structure is presented, breaking down its components like 'Era', 'Payload', and 'AuthHash'.](https://ss.rapidrecap.app/screens/JNW5fHJ-Nyo/00-02-02.png)
![Screenshot at 03:36: The presenter explains the concept of understanding fundamental programming for cybersecurity analysis.](https://ss.rapidrecap.app/screens/JNW5fHJ-Nyo/00-03-36.png)
![Screenshot at 04:01: A course curriculum for "Zero2Hero C Programming" is shown, emphasizing foundational programming skills relevant to cybersecurity.](https://ss.rapidrecap.app/screens/JNW5fHJ-Nyo/00-04-01.png)