WAF enhancements for FortiWeb CVE-2025-64446 and PHP Wrapper Injection

This week highlights enhancements to detection signatures improving coverage for vulnerabilities in FortiWeb, linked to CVE-2025-64446, alongside new detection logic expanding protection against PHP Wrapper Injection techniques.

Key Findings

This vulnerability enables an unauthenticated attacker to bypass access controls by abusing the CGIINFO header. The latest update strengthens detection logic to ensure a reliable identification of crafted requests attempting to exploit this flaw.

Impact

• FortiWeb (CVE-2025-64446): Exploitation allows a remote unauthenticated adversary to circumvent authentication mechanisms by sending a manipulated CGIINFO header to FortiWeb’s backend CGI handler. Successful exploitation grants unintended access to restricted administrative functionality, potentially enabling configuration tampering or system-level actions.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	...4e2e1a2e	N/A	FortiWeb - Authentication Bypass via CGIINFO Header - CVE:CVE-2025-64446	Log	Block	This is a new detection
Cloudflare Managed Ruleset	...b6c44ed5	N/A	PHP Wrapper Injection - Body - Beta	Log	Disabled	This rule has been merged into the original rule "PHP Wrapper Injection - Body" (ID:...1a3e521e)
Cloudflare Managed Ruleset	...900f4015	N/A	PHP Wrapper Injection - URI - Beta	Log	Disabled	This rule has been merged into the original rule "PHP Wrapper Injection - URI" (ID:...8f76bd74)