CVE-2018-13382

What is FortiOS SSL VPN?

FortiOS is the operating system for Fortinet's FortiGate firewalls, and its SSL VPN web portal is the standard mechanism for granting remote employees browser- or client-based access into corporate networks. Because the portal authenticates users against locally or remotely stored credentials before granting VPN access, any flaw that lets an outsider manipulate those credentials directly threatens every account behind the appliance.

Overview

CVE-2018-13382 is an improper authorization vulnerability in the FortiOS and FortiProxy SSL VPN web portal that allows an unauthenticated attacker to modify the password of an SSL VPN user account through a crafted request against the portal's password-change functionality. Rather than requiring valid current credentials, the endpoint fails to enforce that the requester is actually the account owner.

Technical Details

The flaw (CWE-863, Incorrect Authorization) exists in the SSL VPN portal's password-change request handling: the server-side logic does not properly verify that the request originates from an authenticated session belonging to the target account before processing the password update. This is closely associated with CVE-2018-13379 (the pre-auth path traversal disclosed in the same research effort) — in real-world attack chains, adversaries first use the path traversal bug to enumerate valid usernames/sessions, then use this improper-authorization flaw to reset the password and take over the account outright, or simply lock legitimate users out.

Discovery

The vulnerability was identified as part of the same Fortinet SSL VPN research that produced CVE-2018-13379 and CVE-2018-13383, and was addressed by Fortinet through its standard PSIRT disclosure process.

Exploitation Context

CISA's KEV entry confirms real-world exploitation, and this CVE is frequently discussed alongside CVE-2018-13379 as part of a well-documented Fortinet SSL VPN attack chain used by ransomware affiliates and other intrusion actors to gain and maintain unauthorized VPN access into target networks.

Remediation

1. Apply the Fortinet-supplied patch for your FortiOS/FortiProxy version immediately.
2. Treat this as a chain with CVE-2018-13379 and CVE-2018-13383 — patch all three if any are found unpatched on the same device.
3. Force a password reset for all SSL VPN users if the appliance was ever exposed while vulnerable.
4. Enable multi-factor authentication on SSL VPN logins so a password reset alone cannot grant full account takeover.
5. Monitor authentication logs for unexpected password-change events or logins from unfamiliar source addresses following any suspected exposure window.