FortiOS CLI auto-script path traversal enabling arbitrary file write/delete as root

#!/usr/bin/env bash
# CVE-2025-61624 Version Checker for FortiOS
# Checks whether FortiOS firmware is vulnerable to FG-IR-26-122
# Exit codes: 0=PATCHED  1=VULNERABLE  2=UNKNOWN
set -euo pipefail

HOST="${1:?Usage: $0 <host> [ssh-port] [admin-user]}"
PORT="${2:-22}"
USER="${3:-admin}"

echo "[*] Connecting to $HOST:$PORT as $USER ..."
RAW=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new \
  -o BatchMode=yes -p "$PORT" "${USER}@${HOST}" \
  "get system status" 2>/dev/null) || {
  echo "UNKNOWN — SSH connection to $HOST:$PORT failed"
  exit 2
}

# Parse version string (e.g. "Version: FortiGate-100F v7.4.8,build...")
VERLINE=$(echo "$RAW" | grep -i '^Version' | head -1)
if [[ -z "$VERLINE" ]]; then
  echo "UNKNOWN — could not find version line in system status output"
  exit 2
fi

# Extract numeric version
VERSION=$(echo "$VERLINE" | grep -oP 'v\K[0-9]+\.[0-9]+\.[0-9]+')
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not parse version number from: $VERLINE"
  exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

echo "[*] Detected FortiOS version: $VERSION (major=$MAJOR minor=$MINOR patch=$PATCH)"

# Also check for IOCs while we're connected
echo "[*] Checking for PEERSTITCH IOCs (auto-script path traversal) ..."
ASCRIPT=$(ssh -o ConnectTimeout=10 -o BatchMode=yes -p "$PORT" "${USER}@${HOST}" \
  "show system auto-script" 2>/dev/null) || ASCRIPT=""
if echo "$ASCRIPT" | grep -q '\.\./'; then
  echo "[!] WARNING: Path traversal sequences detected in system.auto-script objects!"
  echo "[!] This device may be actively compromised. Investigate immediately."
fi

# Version comparison
if (( MAJOR < 6 )); then
  echo "UNKNOWN — FortiOS $VERSION predates known affected range"
  exit 2
elif (( MAJOR == 6 && MINOR == 4 )); then
  echo "VULNERABLE — FortiOS $VERSION (6.4.x all affected; no backport. Migrate to 7.4.10+ or 7.6.5+)"
  exit 1
elif (( MAJOR == 7 && MINOR == 0 )); then
  echo "VULNERABLE — FortiOS $VERSION (7.0.x all affected; no backport. Migrate to 7.4.10+ or 7.6.5+)"
  exit 1
elif (( MAJOR == 7 && MINOR == 2 )); then
  echo "VULNERABLE — FortiOS $VERSION (7.2.x all affected; no backport. Migrate to 7.4.10+ or 7.6.5+)"
  exit 1
elif (( MAJOR == 7 && MINOR == 4 )); then
  if (( PATCH >= 10 )); then
    echo "PATCHED — FortiOS $VERSION (fixed in 7.4.10)"
    exit 0
  else
    echo "VULNERABLE — FortiOS $VERSION (upgrade to 7.4.10+)"
    exit 1
  fi
elif (( MAJOR == 7 && MINOR == 6 )); then
  if (( PATCH >= 5 )); then
    echo "PATCHED — FortiOS $VERSION (fixed in 7.6.5)"
    exit 0
  else
    echo "VULNERABLE — FortiOS $VERSION (upgrade to 7.6.5+)"
    exit 1
  fi
elif (( MAJOR > 7 )) || (( MAJOR == 7 && MINOR > 6 )); then
  echo "PATCHED — FortiOS $VERSION (post-affected branch)"
  exit 0
else
  echo "UNKNOWN — FortiOS $VERSION unrecognized; verify manually against FG-IR-26-122"
  exit 2
fi