FortiOS SSL-VPN Pre-Auth Heap Overflow (XORtigate)

aka XORtigate

Product: Fortinet FortiOS / FortiProxy SSL-VPN
CVE: CVE-2023-27997
Disclosed: 2023-06-11
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: FortiOS 7.2.0-7.2.4, 7.0.0-7.0.11, 6.4.0-6.4.12, 6.2.0-6.2.13, 6.0.0-6.0.16; FortiProxy 7.2.0-7.2.3, 7.0.0-7.0.9, 2.0.x, 1.2.x, 1.1.x.
Fixed: FortiOS 7.2.5, 7.0.12, 6.4.13, 6.2.14, 6.0.17; FortiProxy 7.2.4, 7.0.10.

Summary

LEXFO researchers found a pre-authentication heap overflow in the FortiGate SSL-VPN web interface reachable on any device with SSL-VPN enabled. Fortinet noted it may have been exploited in limited attacks, and hundreds of thousands of devices were exposed.

Root cause

The SSL-VPN login and host-check handlers decode a hex-encoded, XOR-obfuscated parameter. The length check compares the encoded size rather than the decoded payload size, so a crafted value causes the decryption routine to write past the end of a heap buffer, which can be groomed into control-flow hijacking.

Impact

Unauthenticated remote code execution on FortiGate firewalls.

Detection

Version-check FortiOS/FortiProxy; Bishop Fox released a non-intrusive checker. Look for sslvpnd crashes in logs.

Mitigation