Fortinet FortiOS and FortiProxy SSL VPN Path Traversal Vulnerability (CVE-2018-13379) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2018-13379) is a critical Path Traversal (CWE-22) flaw residing in the SSL VPN web portal component of Fortinet FortiOS and FortiProxy. The root cause is the application's failure to properly sanitize and restrict user-supplied input within HTTP resource requests. By utilizing directory traversal sequences (e.g., '../../../../'), an unauthenticated attacker can bypass the web root directory restrictions and access sensitive files on the underlying operating system.

2. Exploitation Mechanics & Attack Scenario

An attacker sends a crafted HTTP GET request targeting the SSL VPN portal (typically on port 10443). By exploiting the vulnerable parameter in the '/remote/fgt_lang' endpoint, the attacker can traverse directories to read the 'sslvpn_websession' file. This system file contains active session tokens along with cleartext usernames and passwords of currently logged-in users. With these stolen credentials, the attacker can establish legitimate VPN connections, bypassing perimeter defenses entirely.

3. Infrastructure & Business Impact

Listed in the CISA KEV catalog, this vulnerability has been heavily exploited in the wild by advanced persistent threat (APT) actors and ransomware operators. Successful exploitation grants initial access to the internal corporate network, which often serves as a stepping stone for lateral movement, domain controller compromise, data exfiltration, and ransomware deployment. With a CVSS score of 9.8, it poses an extreme risk to enterprise infrastructure.