Patchfirst
Patchfirst
CVE-2023-27997 KEVRansomwarePublic exploit Critical · 9.8 EPSS 85.7%

Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

Fortinet · FortiOS and FortiProxy SSL-VPN

Summary

A heap-based buffer overflow in the SSL-VPN component of Fortinet's FortiOS and FortiProxy products allows the flaw to be triggered by specially crafted requests. A remote attacker can exploit it to execute arbitrary code or commands, requiring only network access to the SSL-VPN service, with no authentication or user interaction needed.

Official description · NVD

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Breakdown
83.7 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
4/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 1 day before it was disclosed. Public exploit code (PoC-in-GitHub) appeared 3 days after disclosure.

  1. First seen exploitedVulnCheck KEV evidence1 day before
  2. DisclosedAdded to CISA KEVknown ransomware use; EU database agreesday 0
  3. Public exploit codePoC-in-GitHub+3 days
  4. Named in a threat reporttrendmicro.com+17 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

3 , grouped by in kill-chain order 3

Initial AccessTA0001

Exploit Public-Facing Application T1190
MITRE CTID mapping of the KEV entry · how it is exploited

This buffer overflow vulnerability allows adversaries to remotely execute arbitrary code via specially crafted requests. Adversaries have been observed adding accounts to config files

ExecutionTA0002

Hijack Execution Flow T1574 also Stealth
MITRE CTID mapping of the KEV entry · how it is exploited

PersistenceTA0003

Create Account T1136
MITRE CTID mapping of the KEV entry · primary impact

Detection

1 rule for this CVE · 160 general rules for its techniques

Rules for this CVE

1 that reference CVE-2023-27997 directly.

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Hijack Execution FlowT15748 general rules
Create AccountT11363 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportTrend MicroNov 2024

Reports are matched by finding the exact id CVE-2023-27997 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag (1 duplicate merged)

Vendor Advisory 1

fortiguard.com/psirt/FG-IR-23-097

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997
↑ ↓ chooseEnter openEsc close