CVE-2018-13379: Fortinet FortiOS SSL VPN Path Traversal Vulnerability

CVE-2018-13379 is a path traversal weakness in the SSL VPN web portal of Fortinet FortiOS. An unauthenticated attacker can send specially crafted HTTP resource requests to download FortiOS system files. Because the flaw sits on a network-facing VPN service and has been used in ransomware operations, it matters to any organization that exposes FortiOS SSL VPN to the internet or untrusted networks.

Public detail is limited to the CISA description and the CWE-22 classification; exact affected builds, scoring, and exploit mechanics must be confirmed against the vendor advisory. The required action is to apply updates per vendor instructions.

How it works

The vulnerability belongs to the path-traversal class (CWE-22). In products that serve files or resources over HTTP, insufficient validation of user-supplied path elements can let an attacker escape the intended directory and read arbitrary files on the system.

In this case the FortiOS SSL VPN web portal fails to properly constrain resource requests. An unauthenticated remote attacker crafts HTTP requests that traverse outside the portal’s normal document root and retrieve FortiOS system files. Those files may contain configuration data, credentials, or other sensitive material that can be used for further access. No authentication is required, so the attack surface is any reachable SSL VPN portal instance that has not been patched or mitigated.

Am I affected? How to find it in your systems

FortiOS is the operating system that runs on Fortinet FortiGate firewalls and related appliances. The SSL VPN web portal is commonly enabled to give remote users secure access. Inventory every FortiGate or FortiOS device that presents an SSL VPN service on any interface, especially those reachable from the internet or partner networks.

• Enumerate devices via your CMDB, network scanners, or FortiManager/FortiAnalyzer inventories; note firmware version and whether the SSL VPN portal is enabled.
• Compare the running FortiOS version and SSL VPN configuration against the vendor advisory for CVE-2018-13379; do not rely on version ranges stated elsewhere.
• Review web-server or VPN access logs for unusual HTTP resource requests that contain directory-traversal sequences or that request files outside normal portal paths.
• Check authentication and system logs for subsequent anomalous logins, configuration changes, or file-access events that could indicate follow-on activity after a successful file download.

If logging is incomplete, treat any unpatched, internet-facing SSL VPN portal as potentially exposed until proven otherwise.

How to remediate

Patch first. Apply the FortiOS updates specified by Fortinet for CVE-2018-13379 exactly as described in the vendor advisory. CISA’s required action is to apply updates per vendor instructions; verify the fixed version and any prerequisite steps directly from that advisory before deployment.

• Schedule and test the update in a maintenance window; confirm the SSL VPN service restarts cleanly and that legitimate users can still connect.
• After patching, re-validate that the portal no longer accepts the traversal patterns described in the advisory.
• As hardening for this class of flaw, ensure the SSL VPN portal is bound only to necessary interfaces, disable unused portal features, and keep FortiOS current on a regular cadence.
• Rotate any credentials or secrets that may have resided in system files readable through the portal, and review VPN user accounts for unauthorized additions.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment or firewall the SSL VPN portal so it is reachable only from trusted source addresses or through a jump host; block general internet access if business needs allow.
• Place a web application firewall or reverse-proxy rule in front of the portal to drop requests containing path-traversal sequences or anomalous resource paths; tune carefully to avoid breaking legitimate clients.
• If the SSL VPN feature is not required, disable the web portal entirely until patching is complete.
• Increase monitoring: alert on unusual HTTP request patterns, large or unexpected file downloads from the portal, and any new VPN sessions or administrative logins following suspicious requests.
• Ensure offline backups of FortiOS configurations are current and stored securely so recovery is possible if compromise is later confirmed.

These measures lower risk but do not replace the vendor patch.

If your data may have been exposed

Actively exploited vulnerabilities of this type have been leveraged in ransomware campaigns. If logs or other evidence suggest system files were downloaded, treat the incident as a potential breach: isolate affected devices, preserve logs, rotate credentials, and follow your incident-response plan. You can also run a free exposure scan of your email addresses against known breach data sets to check whether associated accounts appear in prior compromises.