FortiOS heap overflow enables unauthenticated RCE
Fortinet disclosed a heap-based buffer overflow in FortiOS and FortiProxy that lets unauthenticated remote attackers execute arbitrary code via crafted requests.
Japan's IPA issued an alert reproducing Fortinet's disclosure of a heap-based buffer overflow vulnerability affecting FortiOS and FortiProxy. An unauthenticated remote attacker can send specially crafted requests to trigger the overflow and potentially execute arbitrary code or commands on the affected device, which typically sits at the network perimeter as a VPN/firewall appliance.
The advisory urges administrators to apply Fortinet's patched releases as soon as possible, noting that damage could expand if left unaddressed. Fortinet also published workarounds to mitigate exposure for organizations unable to patch immediately. Given Fortinet's history of similar SSL-VPN flaws being rapidly weaponized after disclosure, this issue warrants prompt remediation even though the bulletin itself does not confirm in-the-wild exploitation.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by FortiOS Web/VPN Daemon
Detects a shell or interpreter process spawned by FortiOS/FortiProxy web-facing daemons (sslvpnd, httpsd, wad), consistent with post-exploitation of an unauthenticated heap overflow RCE in the SSL-VPN/management interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by FortiOS Web/VPN Daemon
id: 6fdffda7-fd94-59ad-a308-1002a38dd72f
status: experimental
description: 'Detects shell or scripting interpreters spawned as children of FortiOS/FortiProxy
network-facing daemons (sslvpnd, httpsd, wad). These daemons handle unauthenticated
remote requests over the SSL-VPN and management interfaces; a heap-based buffer
overflow in these services could allow an attacker to execute arbitrary commands.
A shell spawned from these processes is not expected under normal operation.
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /sslvpnd
- /httpsd
- /wad
- /forticron
suspicious_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
- /python
- /python3
- /perl
- /nc
- /curl
- /wget
condition: selection and suspicious_child
falsepositives:
- Legitimate diagnostic scripts triggered by FortiOS internal health-check or update
mechanisms that invoke shell utilities
- Vendor-supplied maintenance scripts executed via cron-like FortiOS internal tasks
level: high
Outbound Network Connection Initiated by FortiOS VPN/Management Daemon
Flags outbound network connections initiated directly by FortiOS SSL-VPN or web-management daemon processes, which may indicate a reverse shell or callback following exploitation of an unauthenticated RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Connection Initiated by FortiOS VPN or Management Daemon
id: 57bae0eb-d167-5da3-a2e0-0d5ddde67474
status: experimental
description: 'Detects outbound network connections initiated by FortiOS/FortiProxy
processes
that normally only accept inbound connections (sslvpnd, httpsd). Outbound
connections from these daemons can indicate a reverse shell or C2 callback
established after successful exploitation of a heap overflow RCE vulnerability.
This is a low-volume, high-signal behavior that should be tuned against known
legitimate update/telemetry endpoints for the specific appliance environment.
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
logsource:
category: network_connection
product: linux
detection:
selection:
Image|endswith:
- /sslvpnd
- /httpsd
Initiated: 'true'
filter_updates:
DestinationHostname|contains:
- fortinet.com
- fortiguard.com
condition: selection and not filter_updates
falsepositives:
- Legitimate FortiGuard update, licensing, or telemetry connections initiated by the
daemon itself
- Outbound connections to configured syslog/SNMP/webhook endpoints as part of normal
appliance operation
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20230613.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free