CVE-2018-13383
Fortinet FortiOS and FortiProxy Out-of-bounds Write
Description
CVE-2018-13383 is a heap buffer overflow vulnerability in Fortinet FortiOS and FortiProxy that affects the SSL VPN web service. The vulnerability is triggered when the SSL VPN web portal improperly handles JavaScript href data while proxying webpages, causing a heap buffer overflow that can terminate the SSL VPN web service for logged-in users. While rated medium severity with a CVSS score of 4.3, this out-of-bounds write vulnerability in FortiOS and FortiProxy has been added to CISA's Known Exploited Vulnerabilities catalog and is known to be leveraged in ransomware campaigns, underscoring its real-world significance despite its moderate CVSS rating.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | < 1.2.9; 2.0.0 |
| fortinet | fortios | >= 5.2.0, < 5.2.15; >= 5.4.0, < 5.4.13; >= 5.6.0, < 5.6.11; >= 6.0.0, < 6.0.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- https://fortiguard.com/advisory/FG-IR-18-388(Mitigation, Vendor Advisory)
- https://fortiguard.com/advisory/FG-IR-20-229(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13383(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
In the context of CVE-2018-13383, the heap buffer overflow occurs when Fortinet FortiOS and FortiProxy's SSL VPN web portal processes JavaScript href data during webpage proxying. The out-of-bounds write corrupts heap memory, which can cause the SSL VPN web service to crash. Out-of-bounds writes are extremely dangerous as they can corrupt adjacent data or overwrite control flow information, potentially leading beyond denial of service to arbitrary code execution.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2018-13383 has a CVSS 3.1 score of 4.3 (MEDIUM), which may understate its real-world risk given its KEV listing and ransomware associations. The vulnerability is remotely exploitable over the network with low attack complexity and requires low-level privileges but no user interaction. Availability (Low): the primary documented impact is termination of the SSL VPN web service for logged-in users, causing a denial-of-service condition. While the CVSS scoring indicates no confidentiality or integrity impact, the vulnerability's inclusion in CISA's KEV catalog and its known use in ransomware campaigns suggest that attackers have found ways to chain this heap buffer overflow with other vulnerabilities for more severe impact. The EPSS score of 1.35% (79.89th percentile) indicates a notable probability of exploitation.
Exploit Maturity
CVE-2018-13383 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, and it is known to be leveraged in ransomware campaigns. The remediation deadline set by CISA was 2022-07-10. The EPSS score of 1.35% (79.89th percentile) indicates a notable exploitation probability. This vulnerability is commonly exploited alongside other Fortinet SSL VPN vulnerabilities, particularly CVE-2018-13379 (path traversal for credential theft) and CVE-2018-13382 (authorization bypass for password modification), forming an attack chain that threat actors use to compromise enterprise VPN infrastructure and deploy ransomware.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade FortiOS to version 5.2.15+, 5.4.13+, 5.6.11+, or 6.0.5+ and FortiProxy to version 1.2.9+ to address this heap buffer overflow.
- Verify all FortiOS and FortiProxy instances, including FortiOS versions 5.2.0 through 5.2.14, 5.4.0 through 5.4.12, 5.6.0 through 5.6.10, 6.0.0 through 6.0.4, and FortiProxy versions up to 1.2.8 and 2.0.0, and ensure all are updated to patched versions.
- Restrict SSL VPN web portal access to trusted IP ranges and implement web application firewall rules to filter malicious JavaScript content in proxied web traffic, reducing the attack surface for this heap overflow.
- Monitor SSL VPN service stability for unexpected crashes or restarts of the web service, which may indicate active exploitation attempts targeting the heap buffer overflow in the JavaScript href processing.
- Assess the broader Fortinet VPN attack surface by also verifying patches for related vulnerabilities CVE-2018-13379 and CVE-2018-13382, as these are commonly chained together in ransomware campaigns targeting Fortinet devices.
Technical Details
CVE-2018-13383 is caused by CWE-787 (Out-of-bounds Write) in the SSL VPN web portal component of Fortinet FortiOS and FortiProxy. The heap buffer overflow is triggered when the SSL VPN proxy processes JavaScript href data from webpages being proxied for authenticated VPN users. The failure to properly validate the length or content of href data before writing it to a heap-allocated buffer results in a write beyond the buffer boundary. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L reflects that exploitation requires low privileges (an authenticated VPN session), but the attack itself is low complexity and needs no additional user interaction. The vulnerability affects a wide range of FortiOS versions from 5.2.0 through 6.0.4 and FortiProxy versions up to 1.2.8 and 2.0.0, indicating the vulnerable code existed in the codebase for an extended period.
Frequently Asked Questions
Is CVE-2018-13383 being actively exploited?
Yes. CVE-2018-13383 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. It is also known to be leveraged in ransomware campaigns, typically in combination with other Fortinet SSL VPN vulnerabilities such as CVE-2018-13379 and CVE-2018-13382.
What products are affected by CVE-2018-13383?
CVE-2018-13383 affects Fortinet FortiOS versions 5.2.0 through 5.2.14, 5.4.0 through 5.4.12, 5.6.0 through 5.6.10, and 6.0.0 through 6.0.4, as well as FortiProxy versions up to 1.2.8 and 2.0.0. All affected versions contain the heap buffer overflow in the SSL VPN web portal.
How do I fix CVE-2018-13383?
Upgrade FortiOS to version 5.2.15 or later, 5.4.13 or later, 5.6.11 or later, or 6.0.5 or later, and upgrade FortiProxy to version 1.2.9 or later. Additionally, restrict SSL VPN portal access to trusted networks and monitor for unexpected service crashes.
How severe is CVE-2018-13383?
CVE-2018-13383 has a CVSS 3.1 score of 4.3 (MEDIUM), but its real-world severity is elevated by its CISA KEV listing and confirmed use in ransomware campaigns. The heap buffer overflow can cause denial of service and may be chained with other Fortinet vulnerabilities for more severe attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.