WAF - WAF Release - 2025-11-24

This week highlights enhancements to detection signatures improving coverage for vulnerabilities in FortiWeb, linked to CVE-2025-64446, alongside new detection logic expanding protection against PHP Wrapper Injection techniques.

Key Findings

This vulnerability enables an unauthenticated attacker to bypass access controls by abusing the CGIINFO header. The latest update strengthens detection logic to ensure a reliable identification of crafted requests attempting to exploit this flaw.

Impact

• FortiWeb (CVE-2025-64446): Exploitation allows a remote unauthenticated adversary to circumvent authentication mechanisms by sending a manipulated CGIINFO header to FortiWeb’s backend CGI handler. Successful exploitation grants unintended access to restricted administrative functionality, potentially enabling configuration tampering or system-level actions.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...4e2e1a2eN/AFortiWeb - Authentication Bypass via CGIINFO Header - CVE:CVE-2025-64446LogBlockThis is a new detectionCloudflare Managed Ruleset...b6c44ed5N/APHP Wrapper Injection - Body - BetaLogDisabledThis rule has been merged into the original rule "PHP Wrapper Injection - Body" (ID:...1a3e521e)Cloudflare Managed Ruleset...900f4015N/APHP Wrapper Injection - URI - BetaLogDisabledThis rule has been merged into the original rule "PHP Wrapper Injection - URI" (ID:...8f76bd74)