FortiOS heap overflow enables unauthenticated RCE
Fortinet disclosed a heap-based buffer overflow in FortiOS and FortiProxy that lets unauthenticated remote attackers execute arbitrary code via crafted requests.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2023-27997 as exploited in the wild.
Japan's IPA issued an alert reproducing Fortinet's disclosure of a heap-based buffer overflow vulnerability affecting FortiOS and FortiProxy. An unauthenticated remote attacker can send specially crafted requests to trigger the overflow and potentially execute arbitrary code or commands on the affected device, which typically sits at the network perimeter as a VPN/firewall appliance.
The advisory urges administrators to apply Fortinet's patched releases as soon as possible, noting that damage could expand if left unaddressed. Fortinet also published workarounds to mitigate exposure for organizations unable to patch immediately. Given Fortinet's history of similar SSL-VPN flaws being rapidly weaponized after disclosure, this issue warrants prompt remediation even though the bulletin itself does not confirm in-the-wild exploitation.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by FortiOS Web/VPN Daemon
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or interpreter process spawned by FortiOS/FortiProxy web-facing daemons (sslvpnd, httpsd, wad), consistent with post-exploitation of an unauthenticated heap overflow RCE in the SSL-VPN/management interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by FortiOS Web/VPN Daemon
id: 6fdffda7-fd94-59ad-a308-1002a38dd72f
status: experimental
description: 'Detects shell or scripting interpreters spawned as children of FortiOS/FortiProxy
network-facing daemons (sslvpnd, httpsd, wad). These daemons handle unauthenticated
remote requests over the SSL-VPN and management interfaces; a heap-based buffer
overflow in these services could allow an attacker to execute arbitrary commands.
A shell spawned from these processes is not expected under normal operation.
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /sslvpnd
- /httpsd
- /wad
- /forticron
suspicious_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
- /python
- /python3
- /perl
- /nc
- /curl
- /wget
condition: selection and suspicious_child
falsepositives:
- Legitimate diagnostic scripts triggered by FortiOS internal health-check or update
mechanisms that invoke shell utilities
- Vendor-supplied maintenance scripts executed via cron-like FortiOS internal tasks
level: high
Outbound Network Connection Initiated by FortiOS VPN/Management Daemon
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Flags outbound network connections initiated directly by FortiOS SSL-VPN or web-management daemon processes, which may indicate a reverse shell or callback following exploitation of an unauthenticated RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Connection Initiated by FortiOS VPN or Management Daemon
id: 57bae0eb-d167-5da3-a2e0-0d5ddde67474
status: experimental
description: 'Detects outbound network connections initiated by FortiOS/FortiProxy
processes
that normally only accept inbound connections (sslvpnd, httpsd). Outbound
connections from these daemons can indicate a reverse shell or C2 callback
established after successful exploitation of a heap overflow RCE vulnerability.
This is a low-volume, high-signal behavior that should be tuned against known
legitimate update/telemetry endpoints for the specific appliance environment.
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
logsource:
category: network_connection
product: linux
detection:
selection:
Image|endswith:
- /sslvpnd
- /httpsd
Initiated: 'true'
filter_updates:
DestinationHostname|contains:
- fortinet.com
- fortiguard.com
condition: selection and not filter_updates
falsepositives:
- Legitimate FortiGuard update, licensing, or telemetry connections initiated by the
daemon itself
- Outbound connections to configured syslog/SNMP/webhook endpoints as part of normal
appliance operation
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20230613.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs