CVE-2018-13379 — AI Deep Analysis Summary

🚨 **Essence**: A **Path Traversal** flaw in FortiOS SSL VPN Web Portal. 📂 💥 **Consequences**: Attackers can access files **outside** restricted directories. Critical system files can be downloaded. 🔓

🛡️ **Root Cause**: **Improper Limitation of a Pathname** to a Restricted Directory. 🚫 🔍 **Flaw**: The system fails to filter special elements in resource/file paths correctly. ❌

🏢 **Vendor**: Fortinet (FortiOS & FortiProxy). 📦 📅 **Affected Versions**: • 5.6.3 to 5.6.7 • 6.0.0 to 6.0.4 ⚠️ **Condition**: SSL VPN service (web/tunnel mode) must be enabled. 🔌

🕵️ **Attacker Action**: Unauthenticated download of **system files**. 💾 🔑 **Privileges/Data**: High impact on Confidentiality (C:H) and Availability (A:H). No integrity loss (I:N). 📉

🔓 **Threshold**: **LOW**. 📉 🚫 **Auth**: **Unauthenticated** (PR:N). No login needed. 🔑 🌐 **Access**: Network accessible (AV:N). 🌍

💣 **Public Exp**: **YES**. 🧨 🔗 **PoCs**: Multiple GitHub repos (milo2012, 0xHunter, etc.). 🐙 🛠️ **Tools**: Nmap scripts, Router Scan modules, Python exploits available. 🛠️

🔍 **Self-Check**: • Use **Nmap NSE scripts** for detection. 📡 • Scan via **Project Sonar** data (Tor). 🌐 • Check for specific HTTP resource request responses. 📡

🩹 **Official Fix**: **YES**. 🛡️ 📜 **Advisory**: FortiGuard PSIRT FG-IR-18-384 & FG-IR-20-233. 📄 ✅ **Action**: Update to patched versions immediately. 🔄

🚧 **No Patch?**: • **Disable SSL VPN** if not needed. 🔌 • Restrict access to the SSL VPN web portal via firewall rules. 🚫 • Monitor for unauthorized file access attempts. 👀

🔥 **Urgency**: **HIGH**. 🚨 ⚡ **Priority**: Critical. Unauthenticated + Public Exploit = Immediate Action Required. 🏃‍♂️💨