FortiOS sslvpnd CVE-2022-42475 exploitation indicators via sensitive file paths

Flags FortiOS sslvpnd activity containing known CVE-2022-42475 artifact paths from file-related events.

FreeUnreviewedSigmahighv1

fortios-sslvpnd-cve-2022-42475-exploitation-indicators-via-sensitive-file-paths-293ccb8c

title: FortiOS sslvpnd CVE-2022-42475 exploitation indicators via sensitive file paths
id: 83e495aa-d95c-4d6d-b25b-ee5cf6b2d8c2
status: test
description: This rule matches exploitation indicators for CVE-2022-42475 by looking for specific file paths associated with changes or artifacts on FortiOS running sslvpnd. Attackers exploiting the SSL-VPN issue may leave these files or backups behind, so their appearance can indicate attempted or successful exploitation. It relies on collected FortiOS sslvpnd telemetry that includes file creation or equivalent events, and on keyword matching for the listed paths.
references:
  - https://www.fortiguard.com/psirt/FG-IR-22-398
  - https://www.bleepingcomputer.com/news/security/fortinet-says-ssl-vpn-pre-auth-rce-bug-is-exploited-in-attacks/
  - https://www.deepwatch.com/labs/customer-advisory-fortios-ssl-vpn-vulnerability-cve-2022-42475-exploited-in-the-wild/
  - https://community.fortinet.com/t5/FortiGate/Technical-Tip-Critical-vulnerability-Protect-against-heap-based/ta-p/239420
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-42475/fortios_sslvpnd_exploit_cve_2022_42475_exploitation_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Nilaa Maharjan, Douglasrose75, Huntrule Team
date: 2024-02-08
tags:
  - attack.initial-access
  - cve.2022-42475
  - detection.emerging-threats
logsource:
  product: fortios
  service: sslvpnd
  definition: "Requirements: file creation events or equivalent must be collected from the FortiOS SSL-VPN appliance in order for this detection to function correctly"
detection:
  keywords:
    - /data/etc/wxd.conf
    - /data/lib/libgif.so
    - /data/lib/libips.bak
    - /data/lib/libiptcp.so
    - /data/lib/libipudp.so
    - /data/lib/libjepg.so
    - /var/.sslvpnconfigbk
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 293ccb8c-bed8-4868-8296-bef30e303b7e
    type: derived

What it detects

This rule matches exploitation indicators for CVE-2022-42475 by looking for specific file paths associated with changes or artifacts on FortiOS running sslvpnd. Attackers exploiting the SSL-VPN issue may leave these files or backups behind, so their appearance can indicate attempted or successful exploitation. It relies on collected FortiOS sslvpnd telemetry that includes file creation or equivalent events, and on keyword matching for the listed paths.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.