Webserver Request Indicates Fortinet SSL VPN Path Traversal Attempt (CVE-2018-13379)

title: Webserver Request Indicates Fortinet SSL VPN Path Traversal Attempt (CVE-2018-13379)
id: c0be326a-25dc-4a3e-b7f7-fccacb9aa2e6
status: test
description: This rule flags webserver HTTP requests whose query string contains both a traversal pattern ('lang=/../../') and the path '/dev/cmdb/sslvpn_websession', matching an exploitation attempt pattern targeting Fortinet SSL VPNs. Attackers can use this type of request to reach unintended resources and potentially manipulate the target through crafted URL parameters. The detection relies on webserver telemetry that captures HTTP request URIs and query strings.
references:
  - https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Exploits/CVE-2018-13379/web_cve_2018_13379_fortinet_preauth_read_exploit.yml
author: Bhabesh Raj, Huntrule Team
date: 2020-12-08
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2018-13379
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains|all:
      - lang=/../../
      - /dev/cmdb/sslvpn_websession
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: a2e97350-4285-43f2-a63f-d0daff291738
    type: derived