PT-2019-3002 · Fortinet · Fortiproxy+2

Published 2019-05-24 · Updated 2026-03-10 · CVE-2018-13379

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 5.4.6 through 5.4.12 Fortinet FortiOS versions 5.6.3 through 5.6.7 Fortinet FortiOS versions 6.0.0 through 6.0.4 FortiProxy versions 1.0.0 through 1.0.7 FortiProxy versions 1.1.0 through 1.1.6 FortiProxy versions 1.2.0 through 1.2.8 FortiProxy version 2.0.0

Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as a path traversal vulnerability, in the Fortinet FortiOS SSL VPN web portal. This allows an unauthenticated attacker to download system files via specially crafted HTTP resource requests. The vulnerability has been exploited in real-world incidents, with over 500,000 Fortinet VPN account credentials leaked. Additionally, there have been reports of attackers using this vulnerability to gain access to FortiGate SSL-VPN devices, with over 87,000 devices affected.

Recommendations For Fortinet FortiOS versions 5.4.6 through 5.4.12, update to a patched version to resolve the issue. For Fortinet FortiOS versions 5.6.3 through 5.6.7, update to a patched version to resolve the issue. For Fortinet FortiOS versions 6.0.0 through 6.0.4, update to a patched version to resolve the issue. For FortiProxy versions 1.0.0 through 1.0.7, update to a patched version to resolve the issue. For FortiProxy versions 1.1.0 through 1.1.6, update to a patched version to resolve the issue. For FortiProxy versions 1.2.0 through 1.2.8, update to a patched version to resolve the issue. For FortiProxy version 2.0.0, update to a patched version to resolve the issue. As a temporary workaround, consider restricting access to the SSL VPN web portal until a patch is available. It is also critical to reset passwords after upgrading to a patched version, in case credentials have already been compromised.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-02981

CVE-2018-13379

Affected Products

Fortigate

Fortios

Fortiproxy

References · 93

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/fortios_vpnssl_traversal_creds_leak.rb · Exploit
• 🔥 https://github.com/milo2012/CVE-2018-13379 · Exploit
• 🔥 https://github.com/Blazz3/cve2018-13379-nmap-script · Exploit
• 🔥 https://github.com/k4nfr3/CVE-2018-13379-Fortinet · Exploit
• 🔥 https://github.com/0xHunter/FortiOS-Credentials-Disclosure · Exploit
• 🔥 https://github.com/Zeop-CyberSec/fortios_vpnssl_traversal_leak · Exploit
• 🔥 https://github.com/jpiechowka/at-doom-fortigate · Exploit
• 🔥 https://github.com/B1anda0/CVE-2018-13379 · Exploit
• 🔥 https://exploit-db.com/exploits/47288 · Exploit
• 🔥 https://exploit-db.com/exploits/47287 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13379 · Security Note
• https://bdu.fstec.ru/vul/2019-02981 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-13379 · Security Note
• https://osv.dev/vulnerability/CVE-2018-13379 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-20-233 · Vendor Advisory