.. / CVE-2018-13379

• Info Disclosure
• Nuclei
• Web

Exploit for Fortinet FortiOS - Credentials Disclosure (CVE-2018-13379)

Description:

Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests due to improper limitation of a pathname to a restricted directory (path traversal).

Nuclei Template

View the template here CVE-2018-13379.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2018/CVE-2018-13379.yaml

References: