🚀 CloudSEK has raised $19M Series B1 Round – Powering the Future of Predictive Cybersecurity
Read More
Home
Threat Intelligence Posts
Vulnerability Intelligence

Fortinet SSL-VPN Vulnerability CVE-2018-13379: 49K+ Vulnerable Targets Listed

CloudSEK Threat Intel has detected a threat actor selling a list of systems on the Internet that are vulnerable to CVE-2018-13379 which is a Fortinet SSL VPN path traversal vulnerability.
Updated on
April 19, 2023
Published on
November 21, 2020
Read MINUTES
5
Subscribe to the latest industry news, threats and resources.
 
Advisory Category Vulnerability Management
Vulnerability CVE-2018-13379
Target Fortinet SSL VPN
TLP          Amber
[/vc_wp_text][vc_column_text]CloudSEK Threat Intel has detected a threat actor selling a list of systems on the Internet that are vulnerable to CVE-2018-13379 which is a Fortinet SSL VPN path traversal vulnerability. [caption id="attachment_8712" align="alignnone" width="730"]The threat actor’s post enumerating the list of vulnerable targets The threat actor’s post enumerating the list of vulnerable targets[/caption]

Fortinet SSL-VPN Vulnerability CVE-2018-13379

CVE-2018-13379 is a path traversal vulnerability in FortinetOS SSL VPN web portal which allows unauthenticated attackers to download FortiOS system files by means of specially crafted HTTP request. Vulnerability exists only if SSL VPN service (web mode/tunnel mode) is enabled.  

Vulnerable path

"https://"+ip+"/remote/fgt_lang?lang=</../../../..attacker controlled path>  

Vulnerable Versions

  • FortiOS 6.0 - 6.0.0 to 6.0.4
  • FortiOS 5.6 - 5.6.3 to 5.6.7
  • FortiOS 5.4 - 5.4.6 to 5.4.12
 

Impact 

Technical Impact

  • The attacker can read any files (including system critical files like :config files/password files) from the server
  • Attackers can perform trial and error to search and read sensitive files on the target server.
 

Business Impact

  • Malicious actors can exploit this vulnerability and cause serious downtime resulting in significant financial loss.
  • Since VPN endpoints play a crucial role in business infrastructure, compromise of even a single endpoint may lead to take over of the entire domain or network.
 

Mitigation

  • Install vendor upgrades: Upgrade to FortiOS 5.4.13, 5.6.8, 6.0.5 or 6.2.0 and above
  • Disable SSL VPN service (Work around): https://www.fortiguard.com/psirt/FG-IR-18-384
 
CloudSEK Platform is a no-code platform that powers our products with predictive threat analytic capabilities.
Recent Posts

Recent Articles

Critical CSRF Vulnerability in IBM CICS TX - CVE-2023-42027 Demands Immediate Action
November 15, 2023
CVE-2023-43792 baserCMS is a website development framework vulnerable to Code Injection attacks
November 6, 2023

Get Global Threat Intelligence on Real Time

Protect your business from cyber threats with real-time global threat intelligence data.. 30-day free and No Commitment Trial.
Schedule a Demo
Real time Threat Intelligence Data
More information and context about Underground Chatter
On-Demand Research Services
Dashboard mockup
Global Threat Intelligence Feed

Protect and proceed with Actionable Intelligence

The Global Cyber Threat Intelligence Feed is an innovative platform that gathers information from various sources to help businesses and organizations stay ahead of potential cyber-attacks. This feed provides real-time updates on cyber threats, including malware, phishing scams, and other forms of cybercrime.
Trusted by 400+ Top organisations
Get started
Learn more