CVE-2018-13379

Imagine the SSL VPN portal is like a locked filing cabinet—this bug lets someone reach past the lock using a “trick address” and pull files that should stay hidden. In practical terms, an attacker can download sensitive system files without logging in. Because it has been used in ransomware campaigns, leaving it unpatched increases the chance of a serious breach and downtime.

This matters if you use a Fortinet FortiOS or FortiProxy device that provides SSL VPN web access to users or the internet. It matters most when the SSL VPN web portal is exposed to the network an attacker can reach. Since the attack does not require authentication, it only takes network reachability to become a risk—if the vulnerable SSL VPN web portal is reachable from the internet, assume you are exposed until proven otherwise.

This is RED because CISA lists CVE-2018-13379 in the KEV program and it has been used in ransomware campaigns. Attackers can trigger it remotely without a login by sending crafted web requests to the SSL VPN web portal, which removes a major barrier to abuse.

1. Identify exposure

   • Determine which product you run: Fortinet FortiOS and/or Fortinet FortiProxy.
   • Check your installed version:
     • FortiOS affected: 6.0.0–6.0.4, 5.6.3–5.6.7, and 5.4.6–5.4.12.
     • FortiProxy affected: 2.0.0 and 1.2.0–1.2.8 and 1.1.0–1.1.6 and 1.0.0–1.0.7.
   • Verify whether the SSL VPN web portal is enabled and reachable from any network that could be reached by attackers (especially internet-facing).

2. Confirm likely exploitation indicators (practical checks)

   • Review web access logs around the SSL VPN portal for unauthenticated requests that look unusual or attempt to retrieve files.
   • Look for evidence of downloaded system files or other abnormal responses associated with the SSL VPN web portal.
   • If you have an incident response capability, correlate timestamps with any ransomware detections or suspicious processes.

3. Patch / upgrade (primary remediation)

   • FortiProxy: upgrade to a version fixed for this issue—fixed in 1.2.9.
   • FortiOS: upgrade to the fixed version—fixed in 5.4.13 (per vendor guidance for the affected branch).
   • Follow Fortinet’s vendor instructions for upgrade steps and compatibility notes.

4. If you cannot patch immediately (temporary containment)

   • Restrict access so the SSL VPN web portal is not broadly reachable from the internet (tighten firewall rules / allow-list where possible).
   • Apply the vendor workaround described in the referenced advisory.

5. Compliance and timeline

   • CISA KEV required remediation by 2022-05-03 (for organizations listed under KEV at the time).

6. What to monitor after changes

   • Continue to monitor SSL VPN web portal logs for repeated unauthenticated request patterns.
   • Watch for follow-on signs of compromise (e.g., unusual configuration changes, new accounts, or other indicators consistent with intrusion activity).

7. Validate the fix

   • After upgrading, re-run the version checks and ensure SSL VPN web access is still configured as intended, and that no access is possible from disallowed networks.

CVE-2018-13379 (CWE-22) is a path traversal vulnerability in the Fortinet SSL VPN web portal component on affected FortiOS/FortiProxy versions. The key mechanism is improper restriction of a pathname to a restricted directory, allowing an unauthenticated remote attacker to request crafted HTTP resources that cause the device to disclose system files. Exploitation has been confirmed in the real world: the vulnerability is listed in CISA KEV as used in ransomware campaigns (added 2021-11-03), meaning active adversary use has been documented. A public exploit exists (weaponization available), increasing practical risk. The traffic-light verdict for this CVE is RED, reflecting confirmed exploitation and high impact potential (remote file disclosure and resulting compromise pathways).