CVE-2025-59718: FortiGate SSO Login Bypass — Detection and Containment Guide

---
title: Potential FortiGate SSO Login Bypass - Successful Admin Login
id: 85f2a1d0-4e9c-4b5c-9f12-1a2b3c4d5e6f
status: experimental
description: Detects successful administrative logins on FortiGate devices. While legitimate, a sudden spike or success during non-business hours for SSO logins may indicate CVE-2025-59718 exploitation.
references:
  - https://www.rapid7.com/blog/post/ve-fortigate-cve-2025-59718-exploitation-incident-response-ir-findings
author: Security Arsenal
date: 2025/12/15
tags:
  - attack.initial_access
  - attack.t1078.004
logsource:
  category: firewall
  product: fortinet
detection:
  selection:
    action: 'login'
    status: 'success'
    log_subtype|contains: 'admin'
  filter:
    msg|contains: 'logout' 
  condition: selection and not filter
falsepositives:
  - Legitimate administrator logins
level: medium
---
title: FortiGate Lateral Movement - Outbound Admin Connection
id: 92e3b2c1-5f0d-4a6e-8e23-2b3c4d5e6f7a
status: experimental
description: Detects outbound connections from a FortiGate management interface to internal hosts. Firewalls rarely initiate connections to internal servers; this may indicate attackers pivoting from the appliance.
references:
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2025/12/15
tags:
  - attack.lateral_movement
  - attack.t1021
logsource:
  category: firewall
  product: fortinet
detection:
  selection:
    dst_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
    dst_port:
      - 22
      - 445
      - 3389
      - 5985
      - 5986
    direction: 'outbound'
  condition: selection
falsepositives:
  - Legitimate management traffic to internal jump servers (rare)
level: high

// Hunt for successful admin logins on FortiGate devices
// Look specifically for logins where the user is not a known local admin or occurs via SSO mechanisms without preceding IdP logs
Syslog
| where DeviceVendor == "Fortinet"
| where Facility contains " FortiGate "
| parse SyslogMessage with * "action=" Action: "," * "msg=" Message: "," * "log_subtype=" SubType: "," * 
| where Action == "login"
| where Message contains "success"
| where SubType contains "admin"
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, Action, Message, SubType
| order by TimeGenerated desc


// Detect potential lateral movement from the Firewall itself
// Firewall initiating connections to internal hosts is highly suspicious
CommonSecurityLog
| where DeviceVendor == "Fortinet"
| where DeviceAction in ("accept", "accepted")
| where DestinationPort in (22, 445, 3389, 5985, 5986) // SSH, SMB, RDP, WinRM
| ipv4_is_in_range(SourceIP, "10.0.0.0/8") or ipv4_is_in_range(SourceIP, "192.168.0.0/16") or ipv4_is_in_range(SourceIP, "172.16.0.0/12")
| where DeviceAddress matches regex @"^\d+\.\d+\.\d+\.\d+$" // Ensure device IP exists
| extend IsFirewallSource = iff(SourceIP == DeviceAddress, "True", "False")
| where IsFirewallSource == "True"
| project TimeGenerated, DeviceProduct, SourceIP, DestinationIP, DestinationPort, DeviceAction

-- Hunt for established connections from the compromised FortiGate IP
-- Replace '192.168.1.1' with your Firewall's internal management IP
SELECT State, RemoteAddress, RemotePort, Pid, ProcessName, Username, StartTime
FROM netstat()
WHERE State == 'ESTABLISHED'
  AND RemoteAddress == '192.168.1.1'

#!/bin/bash
# FortiGate CVE-2025-59718 Emergency Hardening
# Use in FortiGate CLI (enable shell if required to run script, otherwise run commands manually)

# 1. Check Current Firmware Version
echo "Checking Firmware Version..."
get system status | grep Version

# 2. Emergency Mitigation: Disable SSO if patch cannot be applied immediately
# WARNING: This will disrupt SSO login for administrators
config system sso
  set status disable
end

echo "SSO Disabled. Check logs for suspicious login attempts."

# 3. Force logout of all admin sessions (Optional, high impact)
execute admin logout-all-users