CVE-2018-13383

What is FortiOS SSL VPN?

FortiOS is the operating system for Fortinet's FortiGate firewalls, and its SSL VPN web service is the component that terminates remote-access VPN connections for employees and partners. Because this service handles authenticated, logged-in sessions directly, a memory-corruption bug in its request handling threatens both availability (crashing active sessions) and, depending on exploitability, potential further memory corruption.

Overview

CVE-2018-13383 is a heap-based buffer overflow in the FortiOS and FortiProxy SSL VPN web service. A specially crafted request sent to the service can overflow a heap buffer, causing the SSL VPN process to crash and terminate the sessions of currently logged-in users. It was disclosed as part of the same body of Fortinet SSL VPN research that produced CVE-2018-13379 (pre-auth path traversal) and CVE-2018-13382 (improper authorization on password change).

Technical Details

The flaw (CWE-787, Out-of-Bounds Write) arises from insufficient bounds checking on attacker-controlled input processed by the SSL VPN service, allowing data to be written past the end of an allocated heap buffer. The publicly documented impact is denial of service — termination of the SSL VPN web service and any active user sessions — reflected in the CVSS vector's availability-only impact (4.3, low privileges required, no confidentiality or integrity impact recorded). Heap overflows of this nature can sometimes be leveraged for further memory corruption or code execution depending on heap layout and mitigations, but the documented/scored impact for this CVE is limited to service disruption.

Discovery

The vulnerability was identified as part of the same 2019 Fortinet SSL VPN security research effort that produced the related path-traversal and authorization CVEs, and was addressed by Fortinet through its standard PSIRT disclosure process.

Exploitation Context

CISA's KEV entry confirms this vulnerability has been exploited in the wild, generally as part of broader campaigns targeting Fortinet SSL VPN appliances alongside CVE-2018-13379 and CVE-2018-13382 — disrupting SSL VPN availability can serve as a denial-of-service tactic or as cover for concurrent credential-harvesting activity against the same devices.

Remediation

1. Apply the Fortinet-supplied patch for your FortiOS/FortiProxy version immediately — treat this as part of the same patch cycle as CVE-2018-13379 and CVE-2018-13382.
2. Monitor SSL VPN service uptime and crash logs for unexpected restarts that could indicate exploitation attempts.
3. Restrict SSL VPN portal exposure to necessary source IP ranges where feasible to reduce the population of potential attackers.
4. Maintain redundant VPN gateway capacity so a targeted DoS against one appliance does not fully disrupt remote access.
5. Review logs from the period the appliance ran a vulnerable build for signs of related exploitation attempts against the other Fortinet SSL VPN CVEs from the same disclosure batch.