# MA-794.112020: MyCERT Alert - SSL VPN vulnerability with credential leaked

**Date:** 27 Nov 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-794.112020  
**Advisory ID:** MA-794.112020

---

**1.0 Introduction**
MyCERT has received several incidents recently referring to the news that a threat actor has published online a list of one-line exploits to steal VPN credentials from over 49,000 vulnerable Fortinet SSL VPN and Malaysia’s networks are listed and could be potentially breached. As a preventive measure, MyCERT release this alert to advise organization to take necessary steps to secure their systems against unwanted incidents as well from other security threats. 
The vulnerability being referred to here is [CVE-2018-13379](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13379), a path traversal vulnerability in the FortiOS SSL VPN web portal that could potentially allow an unauthenticated attacker to download files through specially crafted HTTP resource requests.[1](https://www.fortinet.com/blog/business-and-technology/fortios-ssl-vulnerability)  
By exploiting this vulnerability, unauthenticated remote attackers can access system files via specially crafted HTTP requests. The exploit posted by the hacker lets attackers access the sslvpn\_websession files from Fortinet VPNs to steal login credentials.[2](https://www.bleepingcomputer.com/news/security/hacker-posts-exploits-for-over-49-000-vulnerable-fortinet-vpns/)
**2.0 Impact**
Information disclosure and network intrusion to deploy malicious activities.
**3.0 Affected System and Devices**
- FortiOS 6.0 - 6.0.0 to 6.0.4
- FortiOS 5.6 - 5.6.3 to 5.6.7
- FortiOS 5.4 - 5.4.6 to 5.4.12
- (other branches and versions than above are not impacted)
- ONLY if the SSL VPN service (web-mode or tunnel-mode) is enabled
**4.0 Recommendations**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The current latest versions and workaround can be found below: 
- [FG-IR-18-384](https://www.fortiguard.com/psirt/FG-IR-18-384)
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. https://www.fortinet.com/blog/business-and-technology/fortios-ssl-vulnerability
2. https://www.bleepingcomputer.com/news/security/hacker-posts-exploits-for-over-49-000-vulnerable-fortinet-vpns/
3. https://securityaffairs.co/wordpress/111309/hacking/leak-vulnerable-fortinet-vpns.html