Domain fronting protection bypass in explicit web proxy

Summary

An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS and FortiProxy explicit web proxy may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.

Solution

Upgrade to FortiOS 7.6.4 or above, FortiProxy 7.6.4, 7.4.12 or above

AND

Modify the domain-fronting setting to the new option "strict" for blocking Host header and SNI mismatch when using domain or IP.

config firewall profile-protocol-options
    edit "test"
        set comment "All default services."
        config http
            set ports 80
            unset options
            unset post-lang
            set domain-fronting strict <----- new option (not default)
        end
    ne
end

Acknowledgement

Fortinet is pleased to thank Emanuel Duss from Compass Security for reporting this vulnerability under responsible disclosure.

Timeline

2025-10-14: Initial publication