CVE-2022-42475 PoC — Fortinet FortiOS 缓冲区错误漏洞

Source

https://github.com/AiK1d/CVE-2022-42475-RCE-POC

Associated Vulnerability

Title:Fortinet FortiOS 缓冲区错误漏洞 (CVE-2022-42475)
Description:A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Description

CVE-2022-42475 飞塔RCE漏洞 POC

Readme

# CVE-2022-42475-RCE-POC

漏洞名称

CVE-2022-42475 飞塔RCE漏洞 POC

漏洞成因

由于sslvpnd对用户输入的内容验证存在缺陷，未经身份验证的攻击者通过发送特制数据包触发缓冲区溢出，最终可实现在目标系统上执行任意代码。

受影响版本

2.0 <= FortiOS <= 7.2.2
0.0 <= FortiOS <= 7.0.8
4.0 <= FortiOS <= 6.4.10
2.0 <= FortiOS <= 6.2.11
0.0 <= FortiOS-6K7K <= 7.0.7
4.0 <= FortiOS-6K7K <= 6.4.9
2.0 <= FortiOS-6K7K <= 6.2.11
0.0 <= FortiOS-6K7K <= 6.0.14

不受影响版本

FortiOS >= 7.2.3
FortiOS >= 7.0.9
FortiOS >= 6.4.11
FortiOS >= 6.2.12
FortiOS-6K7K >= 7.0.8
FortiOS-6K7K >= 6.4.10
FortiOS-6K7K >= 6.2.12
FortiOS-6K7K >= 6.0.15

修复方案

目前官方已发布安全版本修复此漏洞
建议受影响的用户及时升级防护：
https://docs.fortinet.com/product/fortigate/7.2

IOC进行自查

检查系统中是否存在以下日志条目：Logdesc=”Application crashed” and msg=”[…] application:sslvpnd,[…], Signal 11 received, Backtrace: […]”

检查系统中是否存在以下文件

/data/lib/libips.bak
/data/lib/libgif.so
/data/lib/libiptcp.so
/data/lib/libipudp.so
/data/lib/libjepg.so
/var/.sslvpnconfigbk
/data/etc/wxd.conf
/flash

用户可通过以下命令来对上述文件进行检查：

diagnose sys last-modified-files /data/lib
diagnose sys last-modified-files /var/
diagnose sys last-modified-files /data/etc/
diagnose sys last-modified-files /flash

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!