CVE-2018-13383

CVE-2018-13383 is a heap buffer overflow (out-of-bounds write, CWE-787) in the SSL VPN web portal of Fortinet FortiOS and FortiProxy. It is triggered when a logged-in SSL VPN user's web session processes crafted JavaScript supplied by a remote site, corrupting heap memory in the SSL VPN web service. An attacker can crash the SSL VPN web service, terminating access for logged-in users, and Fortinet's advisory indicates the memory corruption may allow arbitrary code execution via a crafted JavaScript payload. Organizations running affected FortiOS releases on FortiGate appliances with the SSL VPN web portal enabled, and organizations running FortiProxy secure web gateways, are affected. Exploitation is active: the flaw was added to CISA KEV on 2022-01-10 with known ransomware use, the required action is to apply vendor updates, and EPSS assigns a 33.6% 30-day exploitation probability (98th percentile).

What to do: Apply Fortinet's fixed releases per the vendor advisory (FortiGate/FortiOS: 6.2.1+, 6.0.5+, 5.6.8+, or 5.4.11+ as applicable; FortiProxy: 2.0.1+ or 1.2.9+), consistent with the CISA KEV required action. Until patched, restrict exposure of the SSL VPN web portal to the internet and monitor the appliance for signs of compromise, given the known ransomware use. Prioritize internet-facing SSL VPN endpoints in remediation ordering because of the elevated EPSS score.