CVE-2025-54972 Overview
CVE-2025-54972 is a Carriage Return Line Feed (CRLF) injection vulnerability affecting multiple versions of Fortinet FortiMail. The flaw stems from improper neutralization of CRLF sequences [CWE-93], allowing an attacker to inject headers into HTTP responses. Exploitation requires user interaction, specifically convincing a victim to click a crafted link. Fortinet published the advisory as FG-IR-25-634.
Critical Impact
Successful exploitation enables response header injection, which can facilitate cache poisoning, cross-site scripting, or session-related attacks against authenticated FortiMail users.
Affected Products
- Fortinet FortiMail 7.6.0 through 7.6.3
- Fortinet FortiMail 7.4.0 through 7.4.5
- Fortinet FortiMail 7.2 (all versions) and FortiMail 7.0 (all versions)
Discovery Timeline
- 2025-11-18 - CVE-2025-54972 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54972
Vulnerability Analysis
The vulnerability resides in FortiMail's handling of user-supplied input reflected into HTTP response headers. The application fails to neutralize CRLF sequences (\r\n) before writing values into response headers. An attacker who controls a portion of a request parameter can terminate the current header line and inject additional headers or a response body.
HTTP response splitting attacks derived from CRLF injection can enable web cache poisoning, session fixation, and reflected cross-site scripting. Because FortiMail is a mail security gateway with an administrative and end-user web interface, successful header injection may impact administrator sessions or user webmail sessions.
Exploitation requires user interaction. The attacker must deliver a crafted link to a target user and convince them to click it, placing this vulnerability in the realm of phishing-assisted web attacks rather than direct remote compromise.
Root Cause
The root cause is insufficient input validation on parameters that are reflected into HTTP response headers. The FortiMail web interface does not strip or encode \r (0x0D) and \n (0x0A) bytes before emitting them in header values, violating [CWE-93] Improper Neutralization of CRLF Sequences.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker crafts a URL targeting a vulnerable FortiMail endpoint with CRLF sequences embedded in a parameter that flows into a response header. When the victim clicks the link, the server returns a response with attacker-controlled headers, which the browser processes normally.
No verified proof-of-concept code is publicly available. Refer to the Fortinet PSIRT Report FG-IR-25-634 for vendor-supplied technical detail.
Detection Methods for CVE-2025-54972
Indicators of Compromise
- HTTP requests to FortiMail management or webmail endpoints containing URL-encoded %0d%0a, %0D%0A, or raw \r\n sequences in query parameters
- Unexpected Set-Cookie, Location, or Content-Type headers in FortiMail responses that do not match server-generated defaults
- Referrer logs showing users arriving at FortiMail URLs from external phishing domains
Detection Strategies
- Inspect FortiMail web server access logs for parameter values containing encoded CRLF byte sequences
- Deploy a web application firewall rule that blocks or alerts on %0d%0a patterns in requests to FortiMail hostnames
- Correlate email gateway logs with proxy logs to identify phishing messages containing links to FortiMail URLs with suspicious parameters
Monitoring Recommendations
- Enable verbose HTTP logging on FortiMail and forward logs to a centralized SIEM for parameter-level inspection
- Alert on outbound clicks from corporate users to FortiMail administrative URLs originating from non-corporate email sources
- Baseline normal FortiMail response header sets and flag deviations introduced by injected headers
How to Mitigate CVE-2025-54972
Immediate Actions Required
- Upgrade FortiMail to a fixed release as specified in Fortinet advisory FG-IR-25-634
- Restrict administrative access to the FortiMail web interface to trusted management networks
- Educate administrators and webmail users to avoid clicking FortiMail links delivered through unsolicited email or chat
Patch Information
Fortinet has published remediation guidance in the Fortinet PSIRT Report FG-IR-25-634. Administrators should consult the advisory for the specific fixed build corresponding to their FortiMail major version and follow the vendor upgrade path.
Workarounds
- Place FortiMail's web interface behind a reverse proxy or WAF that strips CRLF sequences from request parameters
- Disable or restrict external exposure of the FortiMail management interface where operationally feasible
- Apply strict URL filtering on the corporate email gateway to block inbound messages containing FortiMail URLs with encoded control characters
# Example WAF rule to block CRLF injection patterns in requests to FortiMail
# ModSecurity rule (illustrative)
SecRule ARGS "@rx (?i)(%0d%0a|%0a%0d|\r\n)" \
"id:1005472,phase:2,deny,status:400,\
msg:'CRLF injection attempt against FortiMail (CVE-2025-54972)',\
logdata:'Matched %{MATCHED_VAR}'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
