CVE-2018-13379

CVE-2018-13379
Fortigate SSL-VPN Credentials Stealer

Yet again, all your creds are belong to us! 😉

Description

A path traversal vulnerability in the Fortigate SSL-VPN web portal allows an unauthenticated attacker to leak users web sessions credentials. Work only if SSL-VPN service ("web-mode" or "tunnel-mode") is enabled.

Author

• iojymbo (@iojymbo)

Credits

• Orange Tsai (@orange_8361) - DEVCORE
• Meh Chang (@mehqq) - DEVCORE

Affected Products

• FortiOS 5.4.6 to 5.4.12
• FortiOS 5.6.3 to 5.6.7
• FortiOS 6.0.0 to 6.0.4

Advisories

• CVE-2018-13379
• FG-IR-18-384

References

• DEVCORE Blog - Breaking the Fortigate SSL-VPN
• Blackhat USA 2019 - Infiltrating Corporate Intranet Like NSA

Date of public disclosure

May 24th, 2019

Google Dork

intitle:"Please Login" intext:"Please Login" inurl:"/remote/login"

Usage

$ python CVE-2018-13379.py -r <RHOST> -p <RPORT>
$ python CVE-2018-13379.py -r 192.168.0.2 -p 443

Tested against

• FortiOS 5.4.6
• FortiOS 5.6.5
• FortiOS 6.0.0
• FortiOS 6.0.2

Solution

Upgrade FortiOS.

Workaround

Disable the SSL-VPN service (both "web-mode" and "tunnel-mode").

License

Usage is provided under the WTFPL license.
See LICENSE for the full details.