FortiOS SSL VPN - Arbitrary File Read (CVE-2018-13379)
- Severity
- CVSSv3 Score
- 9.8
- Vulnerability description
FortiOS SSL VPN server is affected by an Arbitrary File Read through a Path Traversal (broken limitation of a file path to a restricted folder) vulnerability, located in the fgt_lang endpoint and in the lang parameter. The root cause of this vulnerability consists in insufficient checks on the URL, that an attacker can exploit to leak system files with specially crafted HTTP requests.
- Risk description
The risk exists that a remote unauthenticated attacker can fully steal the credentials for all users that are present on the ForstOS SSL VPN server.
- Exploit capabilities
Sniper can read arbitrary files from the target system and extract them as evidence.
- Recommendation
Upgrade to FortiOS 5.4.13, 5.6.8, 6.0.5, 6.2.0 or above.
- Codename
- Not available
- Detectable with
- Network Scanner
- Exploitable with Sniper
- Yes
- Vuln date
- May 2019
- Published at
- Updated at
- Software Type
- VPN gateway
- Vendor
- Fortinet
- Product
- FortiGateway SSL VPN