CVE-2018-13379

What is FortiOS SSL VPN?

FortiOS is the operating system that powers Fortinet's FortiGate line of firewalls, and its built-in SSL VPN web portal is one of the most widely deployed remote-access solutions in enterprise networks, giving employees browser-based or client-based access to internal resources. Because SSL VPN portals are intentionally exposed to the internet — that is their entire purpose — a pre-authentication flaw in the portal itself hands attackers a foothold directly on the perimeter of thousands of organizations at once.

Overview

CVE-2018-13379 is a path traversal vulnerability in the FortiOS SSL VPN web portal that allows an unauthenticated remote attacker to read arbitrary files from the underlying filesystem via specially crafted HTTP resource requests against the portal's language-file handling. The most damaging outcome is that the sslvpn_websession file, which stores VPN session data including usernames and cleartext (or lightly obfuscated) passwords, can be retrieved this way — directly yielding valid VPN credentials without any authentication.

Technical Details

The flaw (CWE-22, Path Traversal) exists in how the SSL VPN portal's web server resolves file paths for certain HTTP GET requests. By manipulating path segments (classic ../ style traversal against endpoints handling language pack or resource file loading) an attacker can escape the intended web root and read arbitrary files readable by the FortiOS process, most notably session state files containing SSL VPN credentials. The attack requires no authentication and no user interaction — a single crafted HTTP request against an internet-facing SSL VPN portal is sufficient.

Discovery

The vulnerability was identified by researchers at Devcore (a Taiwan-based security research firm) as part of broader research into Fortinet and Pulse Secure SSL VPN appliances, and Fortinet released a fixed FortiOS build in response.

Exploitation Context

This is one of the most heavily and persistently exploited vulnerabilities in the KEV catalog. Following public disclosure and PoC release, mass scanning began almost immediately, and by late 2020 a list of roughly 50,000 vulnerable FortiGate devices with harvested VPN credentials was posted on a hacking forum. It has since been used as an initial-access vector by numerous ransomware operators — including groups associated with Ragnar Locker, Cring, and Conti-affiliated actors — as well as by nation-state groups (Fortinet and CISA have both flagged Iranian and other APT actors scanning for and exploiting this bug). CISA and FBI issued joint advisories specifically calling out ongoing exploitation of this CVE for initial access ahead of ransomware deployment.

Remediation

1. Upgrade FortiOS to the fixed release identified in Fortinet's advisory for this CVE immediately if not already done.
2. Assume compromise if the device was ever exposed while running a vulnerable version: reset all SSL VPN account passwords and any credentials that may have been reused elsewhere.
3. Review session logs and sslvpn_websession access for signs the file was retrieved via path traversal.
4. Enable multi-factor authentication on SSL VPN access to reduce the impact of leaked credentials.
5. Restrict SSL VPN portal exposure where feasible and monitor for anomalous authentication from unfamiliar geographies following any suspected credential leak.