Patchfirst
Patchfirst
CVE-2018-13379 KEVRansomwarePublic exploit Critical · 9.8 EPSS >99.9%

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Fortinet · FortiOS

Summary

Fortinet FortiOS (and FortiProxy) contains a path traversal flaw in the SSL VPN web portal, where pathnames are not properly restricted to the intended directory. An unauthenticated remote attacker can exploit it by sending specially crafted HTTP resource requests to the SSL VPN portal, requiring no authentication or user interaction, to download arbitrary system files.

Official description · NVD

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.

Breakdown
89.9 / 100
Exploited
Yes, in CISA KEV
Reports
5
Tactics
1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

First seen exploited 4 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 months after disclosure.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+2 mo
  3. First seen exploitedVulnCheck KEV evidence+4 mo
  4. First dated threat reportIntel 471+2 yrs
  5. Added to CISA KEVknown ransomware use; EU database agrees+2 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

1 , grouped by in kill-chain order, 1 cited passage 1

Initial AccessTA0001

Exploit Public-Facing Application T1190
MITRE CTID mapping of the KEV entry · how it is exploited

This is a path traversal vulnerability that allows adversary to download system files through specially-crafted HTTP requests.

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • Exploitation for Credential AccessT1212 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

1 rule for this CVE · 149 general rules for its techniques

Rules for this CVE

1 that reference CVE-2018-13379 directly.

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 5 threat reports
5 reportsMicrosoft2NCSC UK2Intel 471Nov 2021 – Jun 2022 · 2 undated

Reports are matched by finding the exact id CVE-2018-13379 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Show all 5 reportsShow fewer

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag (2 duplicates merged)

Vendor Advisory 2

fortiguard.com/advisory/FG-IR-18-384fortiguard.com/psirt/FG-IR-20-233

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13379
↑ ↓ chooseEnter openEsc close