Fortinet CVE-2018-13379 Exploitation
Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs
Detection logic
selection
cs-uri-query|contains|all:
- lang=/../../
- /dev/cmdb/sslvpn_websessionCondition
selectionRaw YAML
title: Fortinet CVE-2018-13379 Exploitation
id: a2e97350-4285-43f2-a63f-d0daff291738
status: test
description: Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs
references:
- https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/
author: Bhabesh Raj
date: 2020-12-08
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2018-13379
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains|all:
- 'lang=/../../'
- '/dev/cmdb/sslvpn_websession'
condition: selection
falsepositives:
- Unknown
level: criticalFalse positives
- Unknown