CVE DatabaseCVE-2018-13383

Updated 2026-06-17한국어 권고문 →

CVE-2018-133836.5/MEDIUMCISA KEVCWE-787CWE-787

Fortinet FortiOS & FortiProxy SSL VPN Heap Buffer Overflow Vulnerability (CVE-2018-13383) Technical Advisory

⚡ Jump to Patch

Affected Vendors

fortinet

Affected Components

fortios, fortiproxy

Published Date

2019-05-29

CVSS v3.1

6.5

MEDIUM

EPSS (30d)

32.5%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

FortiOS versions 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier, and FortiProxy versions 2.0.0, 1.2.8 and earlier with SSL VPN web portal enabled

Impact

Remote attackers can trigger a heap buffer overflow by forcing the proxy to process malicious javascript href data, leading to the termination of the SSL VPN web service and disconnection of active user sessions

Mitigation

Immediately upgrade FortiOS and FortiProxy firmware to patched versions, or temporarily disable the SSL VPN web portal feature and restrict access to trusted source IPs

Affected Products & Version Scope

FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.10, 5.4.0 to 5.4.12, 5.2.14 and earlier / FortiProxy 2.0.0, 1.2.8 and earlier

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Upgrade the FortiOS/FortiProxy firmware to a non-vulnerable release as recommended by Fortinet. Verify the current version and perform the upgrade via TFTP.

bash

# Check current FortiOS version and system status
get system status

# Restore/Upgrade firmware image via TFTP server (e.g., upgrading to FortiOS 6.0.5 or higher)
execute restore image tftp FGT_60E-v6-build0366-FORTINET.out 192.168.1.99

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, disable the SSL VPN web portal (restricting access to tunnel mode only) or restrict access to the SSL VPN interface using firewall policies.

bash

# Disable web portal access and enforce tunnel-only mode
config vpn ssl settings
    set source-interface 'wan1'
    set source-address 'all'
    set default-portal 'tunnel-access' # Switch from web-access portal
end

# Restrict SSL VPN access to trusted source IP ranges
config firewall policy
    edit 10
        set srcaddr 'Trusted_IP_Range'
        set dstaddr 'all'
        set action accept
    next
end

3. Log Audit & IoC Verification Commands

Inspect the system crash logs for unexpected SSL VPN daemon terminations and monitor real-time SSL VPN debug logs for anomalies.

bash

# Check system crash logs for sslvpnd process crashes
show system crashlog

# Enable real-time debugging for the SSL VPN application
diagnose debug application sslvpn -1
diagnose debug enable

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild, immediately upgrade all vulnerable FortiOS and FortiProxy instances to secure, patched versions.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2018-13383) is a heap-based buffer overflow (CWE-787) residing within the SSL VPN web portal component of Fortinet FortiOS and FortiProxy. The SSL VPN web portal functions as a reverse proxy to allow authenticated users to access internal web resources. During this process, the portal engine parses and rewrites 'href' links within JavaScript code on proxied web pages. Due to insufficient validation of the length of incoming JavaScript href data, the parser writes data beyond the allocated buffer boundary on the heap.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by hosting or injecting a specially crafted JavaScript payload containing an oversized or malformed 'href' attribute into a web page proxied through the SSL VPN portal. When an authenticated SSL VPN user visits the compromised page, the FortiOS/FortiProxy SSL VPN daemon (sslvpnd) attempts to parse the malicious script. This triggers a heap buffer overflow, corrupting critical memory structures and causing the sslvpnd process to crash, which immediately terminates all active SSL VPN web portal sessions.

3. Infrastructure & Business Impact

This vulnerability is cataloged in CISA's Known Exploited Vulnerabilities (KEV) list, indicating active exploitation in the wild. Successful exploitation allows unauthenticated remote attackers to repeatedly crash the SSL VPN service, resulting in a persistent Denial of Service (DoS) state. This disrupts remote access capabilities for employees and partners, severely impacting business continuity and requiring immediate administrative intervention to restore secure remote connectivity.

Official Vendor Advisories & References

NVD Original English Description

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

https://fortiguard.com/advisory/FG-IR-18-388

Source: psirt@fortinet.com · Mitigation, Vendor Advisory

https://fortiguard.com/advisory/FG-IR-20-229

Source: psirt@fortinet.com · Vendor Advisory

https://fortiguard.com/advisory/FG-IR-18-388

Source: af854a3a-2127-422b-91ae-364da2661108 · Mitigation, Vendor Advisory

https://fortiguard.com/advisory/FG-IR-20-229

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13383

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2018-13383)

FAQ

Q1. How critical is CVE-2018-13383 and is it actively exploited in the wild?

CVE-2018-13383 is rated CVSS 6.5 (MEDIUM) with a 30-day EPSS exploitation probability of 32.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2018-13383?

Primary impacted vendors include fortinet across fortios, fortiproxy. Scope summary: FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.10, 5.4.0 to 5.4.12, 5.2.14 and earlier / FortiProxy 2.0.0, 1.2.8 and earlier

Q3. What temporary mitigations or workarounds exist for CVE-2018-13383 before patching?

[Mitigation] Immediately upgrade FortiOS and FortiProxy firmware to patched versions, or temporarily disable the SSL VPN web portal feature and restrict access to trusted source IPs Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION