{"id":10505,"date":"2025-07-14T12:38:42","date_gmt":"2025-07-14T05:38:42","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=10505"},"modified":"2026-02-05T12:38:53","modified_gmt":"2026-02-05T05:38:53","slug":"fortinet-va-lo-hong-sql-injection-nghiem-trong-tren-fortiweb-cve-2025-25257","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/2025\/07\/14\/fortinet-va-lo-hong-sql-injection-nghiem-trong-tren-fortiweb-cve-2025-25257\/","title":{"rendered":"Fortinet v\u00e1 l\u1ed7 h\u1ed5ng SQL Injection nghi\u00eam tr\u1ecdng tr\u00ean FortiWeb (CVE-2025-25257)"},"content":{"rendered":"<p><b>Fortinet v\u1eeba ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 cho l\u1ed7 h\u1ed5ng CVE-2025-25257 trong s\u1ea3n ph\u1ea9m FortiWeb. L\u1ed7 h\u1ed5ng n\u00e0y \u0111\u01b0\u1ee3c ch\u1ea5m \u0111i\u1ec3m 9,6\/10 theo thang CVSS, cho ph\u00e9p tin t\u1eb7c ch\u01b0a x\u00e1c th\u1ef1c (unauthenticated attacker) th\u1ef1c thi c\u00e1c c\u00e2u l\u1ec7nh SQL \u0111\u1ed9c h\u1ea1i t\u1eeb xa v\u00e0 th\u1eadm ch\u00ed c\u00f3 th\u1ec3 chi\u1ebfm quy\u1ec1n h\u1ec7 th\u1ed1ng n\u1ebfu kh\u00f4ng \u0111\u01b0\u1ee3c x\u1eed l\u00fd k\u1ecbp th\u1eddi.<\/b><\/p>\n<div style=\"text-align: center\">\n<div class=\"bbImageWrapper  js-lbImage\" title=\"1752483170886.png\" data-src=\"https:\/\/whitehat.vn\/attachments\/1752483170886-png.17304\/\" data-lb-sidebar-href=\"\" data-lb-caption-extra-html=\"\" data-single-image=\"1\"><img fetchpriority=\"high\" decoding=\"async\" class=\"bbImage\" title=\"1752483170886.png\" src=\"https:\/\/whitehat.vn\/attachments\/1752483170886-png.17304\/\" alt=\"1752483170886.png\" width=\"728\" height=\"380\" data-url=\"\" data-zoom-target=\"1\" \/><\/div>\n<\/div>\n<p>L\u1ed7 h\u1ed5ng b\u1eaft ngu\u1ed3n t\u1eeb m\u1ed9t h\u00e0m c\u00f3 t\u00ean get_fabric_user_by_token trong th\u00e0nh ph\u1ea7n Fabric Connector &#8211; n\u01a1i ch\u1ecbu tr\u00e1ch nhi\u1ec7m k\u1ebft n\u1ed1i FortiWeb v\u1edbi c\u00e1c s\u1ea3n ph\u1ea9m kh\u00e1c c\u1ee7a Fortinet.<\/p>\n<p>L\u1ed7i thu\u1ed9c v\u1ec1 nh\u00f3m SQL Injection (CWE-89) &#8211; m\u1ed9t l\u1ed7i ph\u1ed5 bi\u1ebfn nh\u01b0ng c\u1ef1c k\u1ef3 nguy hi\u1ec3m n\u1ebfu t\u1ed3n t\u1ea1i \u1edf c\u1ea5p \u0111\u1ed9 API. Khi FortiWeb nh\u1eadn m\u1ed9t y\u00eau c\u1ea7u HTTP c\u00f3 k\u00e8m theo Bearer token trong header (\u0111\u1ea7u y\u00eau c\u1ea7u). H\u1ec7 th\u1ed1ng s\u1ebd g\u1ecdi h\u00e0m get_fabric_user_by_token, sau \u0111\u00f3 g\u1ecdi ti\u1ebfp fabric_access_check.<\/p>\n<p>D\u1eef li\u1ec7u t\u1eeb token n\u00e0y kh\u00f4ng \u0111\u01b0\u1ee3c ki\u1ec3m tra v\u00e0 l\u00e0m s\u1ea1ch (sanitize) \u0111\u00fang c\u00e1ch m\u00e0 v\u1eabn \u0111\u01b0\u1ee3c \u0111\u01b0a th\u1eb3ng v\u00e0o truy v\u1ea5n SQL.<\/p>\n<p>K\u1ebft qu\u1ea3: Tin t\u1eb7c c\u00f3 th\u1ec3 t\u1ef1 vi\u1ebft v\u00e0 th\u1ef1c thi c\u00e2u l\u1ec7nh SQL t\u00f9y \u00fd, d\u00f9 kh\u00f4ng h\u1ec1 \u0111\u0103ng nh\u1eadp v\u00e0o h\u1ec7 th\u1ed1ng.<\/p>\n<p>\u0110\u1eb7c bi\u1ec7t nguy hi\u1ec3m: N\u1ebfu k\u1ebft h\u1ee3p c\u00e2u l\u1ec7nh SQL nh\u01b0 SELECT&#8230; INTO OUTFILE, hacker c\u00f3 th\u1ec3 ghi m\u1ed9t file \u0111\u1ed9c h\u1ea1i l\u00ean h\u1ec7 th\u1ed1ng (v\u00ed d\u1ee5, script Python), sau \u0111\u00f3 th\u1ef1c thi n\u00f3 \u0111\u1ec3 chi\u1ebfm quy\u1ec1n truy c\u1eadp \u2013 t\u1eeb SQL Injection chuy\u1ec3n th\u00e0nh Remote Code Execution (RCE).<\/p>\n<p>C\u00e1c phi\u00ean b\u1ea3n FortiWeb sau \u0111\u00e2y \u0111\u1ec1u b\u1ecb \u1ea3nh h\u01b0\u1edfng:<\/p>\n<ul>\n<li data-xf-list-type=\"ul\">7.6.0 \u2192 7.6.3 \u2192 C\u1eadp nh\u1eadt l\u00ean 7.6.4<\/li>\n<li data-xf-list-type=\"ul\">7.4.0 \u2192 7.4.7 \u2192 C\u1eadp nh\u1eadt l\u00ean 7.4.8<\/li>\n<li data-xf-list-type=\"ul\">7.2.0 \u2192 7.2.10 \u2192 C\u1eadp nh\u1eadt l\u00ean 7.2.11<\/li>\n<li data-xf-list-type=\"ul\">7.0.0 \u2192 7.0.10 \u2192 C\u1eadp nh\u1eadt l\u00ean 7.0.11<\/li>\n<\/ul>\n<p>Fortinet \u0111\u00e3 thay th\u1ebf c\u00e1c truy v\u1ea5n SQL nguy hi\u1ec3m b\u1eb1ng prepared statements (c\u00e2u l\u1ec7nh chu\u1ea9n h\u00f3a) trong b\u1ea3n v\u00e1. SQL Injection kh\u00f4ng c\u1ea7n x\u00e1c th\u1ef1c, t\u1ee9c l\u00e0 hacker kh\u00f4ng c\u1ea7n t\u00e0i kho\u1ea3n h\u1ec7 th\u1ed1ng c\u0169ng c\u00f3 th\u1ec3 khai th\u00e1c \u0111\u01b0\u1ee3c.<\/p>\n<ul>\n<li data-xf-list-type=\"ul\">C\u00e1c API endpoint d\u1ec5 b\u1ecb t\u1ea5n c\u00f4ng bao g\u1ed3m:\n<ul>\n<li data-xf-list-type=\"ul\">\/api\/fabric\/device\/status<\/li>\n<li data-xf-list-type=\"ul\">\/api\/v[0-9]\/fabric\/widget\/<\/li>\n<\/ul>\n<\/li>\n<li data-xf-list-type=\"ul\">N\u1ebfu h\u1ec7 th\u1ed1ng FortiWeb c\u1ee7a t\u1ed5 ch\u1ee9c \u0111ang m\u1edf giao di\u1ec7n qu\u1ea3n tr\u1ecb HTTP\/HTTPS ra internet, nguy c\u01a1 b\u1ecb khai th\u00e1c t\u1eeb xa l\u00e0 r\u1ea5t cao.<\/li>\n<\/ul>\n<p>C\u00e1c gi\u1ea3i ph\u00e1p khuy\u1ebfn ngh\u1ecb:<\/p>\n<ul>\n<li data-xf-list-type=\"ul\">C\u1eadp nh\u1eadt b\u1ea3n v\u00e1 ngay l\u1eadp t\u1ee9c theo \u0111\u00fang phi\u00ean b\u1ea3n FortiWeb \u0111ang s\u1eed d\u1ee5ng.<\/li>\n<li data-xf-list-type=\"ul\">Trong th\u1eddi gian ch\u1edd c\u1eadp nh\u1eadt, n\u00ean v\u00f4 hi\u1ec7u h\u00f3a giao di\u1ec7n qu\u1ea3n tr\u1ecb HTTP\/HTTPS n\u1ebfu kh\u00f4ng c\u1ea7n thi\u1ebft \u2013 \u0111\u00e2y l\u00e0 tuy\u1ebfn t\u1ea5n c\u00f4ng ch\u00ednh.<\/li>\n<li data-xf-list-type=\"ul\">Ki\u1ec3m tra log h\u1ec7 th\u1ed1ng v\u00e0 truy v\u1ea5n SQL \u0111\u1ec3 ph\u00e1t hi\u1ec7n c\u00e1c d\u1ea5u hi\u1ec7u b\u1ecb khai th\u00e1c.<\/li>\n<li data-xf-list-type=\"ul\">\u00c1p d\u1ee5ng nguy\u00ean t\u1eafc &#8220;least privilege&#8221; cho ng\u01b0\u1eddi d\u00f9ng v\u00e0 d\u1ecbch v\u1ee5, h\u1ea1n ch\u1ebf quy\u1ec1n ghi file c\u1ee7a t\u00e0i kho\u1ea3n mysql n\u1ebfu c\u00f3 th\u1ec3.<\/li>\n<li data-xf-list-type=\"ul\">Th\u01b0\u1eddng xuy\u00ean \u0111\u00e1nh gi\u00e1 b\u1ea3o m\u1eadt API, do c\u00e1c API endpoint ng\u00e0y c\u00e0ng l\u00e0 m\u1ee5c ti\u00eau t\u1ea5n c\u00f4ng c\u1ee7a hacker.<\/li>\n<\/ul>\n<p>FortiWeb kh\u00f4ng c\u00f2n l\u00e0 \u201cph\u00e1o \u0111\u00e0i b\u1ea5t kh\u1ea3 x\u00e2m ph\u1ea1m\u201d. S\u1ef1 vi\u1ec7c l\u1ea7n n\u00e0y l\u00e0 l\u1eddi c\u1ea3nh t\u1ec9nh r\u1eb1ng ngay c\u1ea3 c\u00e1c thi\u1ebft b\u1ecb b\u1ea3o m\u1eadt c\u0169ng kh\u00f4ng mi\u1ec5n nhi\u1ec5m v\u1edbi r\u1ee7i ro. M\u1ed9t l\u1ed7i l\u1eadp tr\u00ecnh nh\u1ecf nh\u01b0 thi\u1ebfu ki\u1ec3m tra d\u1eef li\u1ec7u \u0111\u1ea7u v\u00e0o l\u00e0 c\u00f3 th\u1ec3 m\u1edf toang c\u00e1nh c\u1eeda cho tin t\u1eb7c.<\/p>\n<p>V\u1edbi m\u1ee9c \u0111\u1ed9 nghi\u00eam tr\u1ecdng cao, ph\u1ea1m vi \u1ea3nh h\u01b0\u1edfng l\u1edbn v\u00e0 kh\u1ea3 n\u0103ng khai th\u00e1c d\u1ec5 d\u00e0ng, c\u00e1c t\u1ed5 ch\u1ee9c \u0111ang s\u1eed d\u1ee5ng FortiWeb c\u1ea7n h\u00e0nh \u0111\u1ed9ng ngay l\u1eadp t\u1ee9c \u0111\u1ec3 v\u00e1 l\u1ed7i, ki\u1ec3m tra h\u1ec7 th\u1ed1ng v\u00e0 th\u1eaft ch\u1eb7t ki\u1ec3m so\u00e1t truy c\u1eadp.<\/p>\n<div style=\"text-align: right;margin-top: 16px\"><i>Theo: <a href=\"https:\/\/whitehat.vn\/threads\/fortinet-va-lo-hong-sql-injection-nghiem-trong-tren-fortiweb-cve-2025-25257.18559\/\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/whitehat.vn\/threads\/fortinet-va-lo-hong-sql-injection-nghiem-trong-tren-fortiweb-cve-2025-25257.18559\/<\/a><\/i><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Fortinet v\u1eeba ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 cho l\u1ed7 h\u1ed5ng CVE-2025-25257 trong s\u1ea3n ph\u1ea9m FortiWeb. L\u1ed7 h\u1ed5ng n\u00e0y \u0111\u01b0\u1ee3c ch\u1ea5m \u0111i\u1ec3m 9,6\/10 theo thang CVSS, cho ph\u00e9p tin t\u1eb7c ch\u01b0a x\u00e1c th\u1ef1c (unauthenticated attacker) th\u1ef1c thi c\u00e1c c\u00e2u l\u1ec7nh SQL \u0111\u1ed9c h\u1ea1i t\u1eeb xa v\u00e0 th\u1eadm ch\u00ed c\u00f3 th\u1ec3 chi\u1ebfm quy\u1ec1n h\u1ec7 th\u1ed1ng n\u1ebfu kh\u00f4ng \u0111\u01b0\u1ee3c [&hellip;]<\/p>\n","protected":false},"author":46,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[],"class_list":["post-10505","post","type-post","status-publish","format-standard","hentry","category-tin-tuc-cua-vien"],"_links":{"self":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/comments?post=10505"}],"version-history":[{"count":0,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10505\/revisions"}],"wp:attachment":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/media?parent=10505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/categories?post=10505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/tags?post=10505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}