CVE-2018-13379
Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Description
CVE-2018-13379 is a CRITICAL path traversal vulnerability affecting Fortinet FortiOS and FortiProxy SSL VPN, carrying a CVSS 3.1 score of 9.1. An Improper Limitation of a Pathname to a Restricted Directory in the SSL VPN web portal allows an unauthenticated attacker to download system files via specially crafted HTTP resource requests. Affected versions include FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7, 5.4.6 to 5.4.12, and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. With an EPSS score of 0.94475 (99.998th percentile), this vulnerability has one of the highest exploitation probabilities tracked and has been extensively used by ransomware operators and nation-state actors alike.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | < 1.2.9; 2.0.0 |
| fortinet | fortios | >= 5.4.6, < 5.4.13; >= 5.6.3, < 5.6.8; >= 6.0.0, < 6.0.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.com/advisory/FG-IR-18-384(Mitigation, Vendor Advisory)
- https://www.fortiguard.com/psirt/FG-IR-20-233(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13379(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2018-13379 is classified under CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Path Traversal occurs when software uses external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory, but fails to properly neutralize special elements such as ".." and "/" that can cause the pathname to resolve to a location outside of the restricted directory. Attackers exploit this weakness by manipulating file path references using sequences like "../" to escape the intended directory and access arbitrary files on the system.
In the context of FortiOS SSL VPN, this weakness is particularly devastating because the vulnerable endpoint exposes session files containing plaintext credentials. Attackers can harvest VPN usernames and passwords without any authentication, gaining direct access to corporate networks. This vulnerability has been one of the most widely exploited VPN flaws in recent history, with leaked credential dumps containing hundreds of thousands of compromised FortiGate devices.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2018-13379 carries a CVSS 3.1 score of 9.1 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation allows unauthenticated attackers to download sensitive system files from the FortiOS SSL VPN web portal. Most critically, attackers can access session files that contain plaintext VPN credentials, exposing usernames and passwords of all connected users.
Integrity (NONE): The vulnerability itself does not directly allow modification of data on the target system. However, the stolen credentials enable subsequent attacks that compromise integrity.
Availability (HIGH): While the path traversal itself does not directly cause denial of service, mass exploitation and credential theft can lead to downstream attacks that severely impact availability of corporate networks accessed via the compromised VPN.
Scope Unchanged: The vulnerability's impact is contained within the FortiOS/FortiProxy component, though stolen credentials enable lateral movement into connected networks.
With an EPSS score of 0.94475 (99.998th percentile), this is one of the most actively exploited vulnerabilities in existence, with confirmed use by APT groups, ransomware operators, and commodity threat actors worldwide.
Exploit Maturity
CVE-2018-13379 has extensive confirmed exploitation in the wild and is one of the most widely abused VPN vulnerabilities in recent cybersecurity history.
Exploit status: Multiple public exploit modules are available, including Metasploit modules and standalone proof-of-concept scripts. The vulnerability was actively exploited as a zero-day before patches were available. In November 2020, a threat actor published a list of approximately 50,000 vulnerable FortiGate VPN devices, and in September 2021, a leak of nearly 500,000 FortiGate VPN credentials was published on a dark web forum.
Ransomware association: This vulnerability has confirmed association with ransomware campaigns. Multiple ransomware groups including Conti, LockBit, and others have leveraged stolen FortiOS VPN credentials as an initial access vector for deploying ransomware across enterprise networks.
Attack surface: The vulnerability affects internet-facing SSL VPN portals, making it trivially discoverable via mass scanning. The exploit requires only a single HTTP request, making it extremely easy to weaponize at scale.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. Given the extreme exploitation activity, immediate remediation is critical for all organizations.
Remediation
- Upgrade FortiOS and FortiProxy immediately. Update to FortiOS 6.0.5 or later, 5.6.8 or later, or 5.4.13 or later. Update FortiProxy to 2.0.1 or later, 1.2.9 or later, 1.1.7 or later, or 1.0.8 or later. Consult Fortinet's PSIRT advisory FG-IR-18-384 for complete version guidance.
- Reset all VPN user credentials after patching. Because this vulnerability exposes plaintext credentials, assume all VPN user passwords have been compromised. Force a password reset for all SSL VPN users and invalidate all active sessions.
- Enable multi-factor authentication (MFA) for VPN access. Deploy MFA on all FortiGate SSL VPN portals to mitigate the impact of any previously stolen credentials that have not yet been used.
- Audit VPN access logs for suspicious activity. Review logs for unusual login patterns, access from unexpected geographic locations, or connections from known malicious IP addresses. Check if any credentials appeared in the September 2021 credential dump.
- Scan for indicators of compromise. Given the widespread exploitation, search for signs of lateral movement, persistence mechanisms, and ransomware precursor activities on systems accessible through the VPN.
- Implement network segmentation. Ensure VPN-connected users have access only to resources they need, limiting the blast radius if credentials are compromised again in the future.
Technical Details
CVE-2018-13379 is a CRITICAL-severity path traversal vulnerability in the Fortinet FortiOS SSL VPN web portal that can be exploited remotely without any authentication or user interaction. The attack complexity is low, requiring only a single crafted HTTP request.
Technical mechanism: The SSL VPN web portal fails to properly sanitize the language parameter in HTTP requests. By sending a specially crafted request to the endpoint /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession, an attacker can traverse out of the intended directory and read the VPN session file. This file contains plaintext usernames and passwords of currently connected VPN users. The vulnerability exists because the web server does not validate that the resolved file path remains within the intended directory.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H reflects the network-accessible attack vector requiring no authentication or user interaction, with high confidentiality and availability impact but no direct integrity impact. The unchanged scope indicates impact is contained within the FortiOS component.
Affected versions: FortiOS 6.0.0-6.0.4, 5.6.3-5.6.7, 5.4.6-5.4.12, and FortiProxy 2.0.0, 1.2.0-1.2.8, 1.1.0-1.1.6, 1.0.0-1.0.7.
Frequently Asked Questions
Is CVE-2018-13379 being actively exploited?
Yes, CVE-2018-13379 is one of the most actively exploited vulnerabilities in recent history. It has been used by nation-state actors, ransomware groups, and commodity threat actors. In 2021, approximately 500,000 FortiGate VPN credentials were leaked on a dark web forum, all harvested using this vulnerability. The EPSS score of 0.94475 (99.998th percentile) reflects the extreme exploitation activity.
What products are affected by CVE-2018-13379?
Affected products include FortiOS versions 6.0.0 to 6.0.4, 5.6.3 to 5.6.7, and 5.4.6 to 5.4.12, as well as FortiProxy versions 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, and 1.0.0 to 1.0.7. Any organization using FortiGate SSL VPN with these versions should assume credentials have been compromised.
How do I fix CVE-2018-13379?
Upgrade FortiOS to version 6.0.5+, 5.6.8+, or 5.4.13+ and FortiProxy to the latest patched version. After patching, immediately reset all VPN user passwords and enable multi-factor authentication. Review VPN logs for unauthorized access and scan for indicators of compromise.
How severe is CVE-2018-13379?
CVE-2018-13379 is rated CRITICAL with a CVSS score of 9.1 and an EPSS score in the 99.998th percentile. It has confirmed ransomware association, was used in massive credential theft campaigns, and remains one of the most exploited vulnerabilities tracked by CISA. Immediate remediation is essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.