CVE-2025-54822
📋 TL;DR
An authenticated attacker can access static files from other VDOMs (Virtual Domains) in affected Fortinet products by sending specially crafted HTTP/HTTPS requests. This improper authorization vulnerability affects FortiOS and FortiProxy across multiple versions, allowing cross-VDOM data leakage.
💻 Affected Systems
- Fortinet FortiOS
- Fortinet FortiProxy
📦 What is this software?
Fortios by Fortinet
Fortios by Fortinet
Fortiproxy by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Sensitive configuration files, certificates, or other static data from other VDOMs could be exfiltrated, potentially enabling further attacks or exposing confidential information.
Likely Case
Limited data exposure from other VDOMs, potentially revealing configuration details or other non-critical static files.
If Mitigated
Minimal impact with proper VDOM segregation and access controls in place.
🎯 Exploit Status
Requires valid authentication credentials and knowledge of VDOM structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiOS 7.4.2, 7.2.9, 7.0.12; FortiProxy 7.4.9, 7.2.1, 7.0.1, 2.0.1
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-684
Restart Required: No
Instructions:
1. Download appropriate firmware version from Fortinet support portal. 2. Backup configuration. 3. Apply firmware update via web interface or CLI. 4. Verify successful upgrade.
🔧 Temporary Workarounds
Restrict VDOM Access
allImplement strict access controls between VDOMs and limit authenticated user permissions.
config system admin
edit <admin_user>
set accprofile <restricted_profile>
end
🧯 If You Can't Patch
- Implement network segmentation to isolate VDOM traffic.
- Enable detailed logging and monitoring for cross-VDOM file access attempts.
🔍 How to Verify
Check if Vulnerable:
Check current version with 'get system status' and compare against affected versions.Check Version:
get system status | grep VersionVerify Fix Applied:
Verify version is patched with 'get system status' showing version >= FortiOS 7.4.2, 7.2.9, 7.0.12 or FortiProxy 7.4.9, 7.2.1, 7.0.1, 2.0.1.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP/HTTPS requests accessing static files across VDOM boundaries
- Failed authorization attempts for cross-VDOM resources
Network Indicators:
- HTTP requests with crafted parameters targeting static files
- Unexpected file transfers between VDOMs
SIEM Query:
source="fortigate" AND (url="*static*" OR url="*file*") AND src_vdom!=dst_vdom