# FortiOS heap overflow enables unauthenticated RCE

Published: 2023-06-13 · Severity: high
Canonical: https://vorant.io/reports/e0e876ad-dcf1-5773-adbb-5bd6be75b83b/fortios-heap-overflow-enables-unauthenticated-rce

> Fortinet disclosed a heap-based buffer overflow in FortiOS and FortiProxy that lets unauthenticated remote attackers execute arbitrary code via crafted requests.

Japan's IPA issued an alert reproducing Fortinet's disclosure of a heap-based buffer overflow vulnerability affecting FortiOS and FortiProxy. An unauthenticated remote attacker can send specially crafted requests to trigger the overflow and potentially execute arbitrary code or commands on the affected device, which typically sits at the network perimeter as a VPN/firewall appliance.

The advisory urges administrators to apply Fortinet's patched releases as soon as possible, noting that damage could expand if left unaddressed. Fortinet also published workarounds to mitigate exposure for organizations unable to patch immediately. Given Fortinet's history of similar SSL-VPN flaws being rapidly weaponized after disclosure, this issue warrants prompt remediation even though the bulletin itself does not confirm in-the-wild exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2023-27997 (KEV)

## Detection guidance (public sample)

### Suspicious Child Process Spawned by FortiOS Web/VPN Daemon

ATT&CK: T1190

Detects a shell or interpreter process spawned by FortiOS/FortiProxy web-facing daemons (sslvpnd, httpsd, wad), consistent with post-exploitation of an unauthenticated heap overflow RCE in the SSL-VPN/management interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by FortiOS Web/VPN Daemon
id: 6fdffda7-fd94-59ad-a308-1002a38dd72f
status: experimental
description: 'Detects shell or scripting interpreters spawned as children of FortiOS/FortiProxy

  network-facing daemons (sslvpnd, httpsd, wad). These daemons handle unauthenticated

  remote requests over the SSL-VPN and management interfaces; a heap-based buffer

  overflow in these services could allow an attacker to execute arbitrary commands.

  A shell spawned from these processes is not expected under normal operation.

  '
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /sslvpnd
    - /httpsd
    - /wad
    - /forticron
  suspicious_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
    - /python
    - /python3
    - /perl
    - /nc
    - /curl
    - /wget
  condition: selection and suspicious_child
falsepositives:
- Legitimate diagnostic scripts triggered by FortiOS internal health-check or update
  mechanisms that invoke shell utilities
- Vendor-supplied maintenance scripts executed via cron-like FortiOS internal tasks
level: high
```

### Outbound Network Connection Initiated by FortiOS VPN/Management Daemon

ATT&CK: T1190

Flags outbound network connections initiated directly by FortiOS SSL-VPN or web-management daemon processes, which may indicate a reverse shell or callback following exploitation of an unauthenticated RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound Connection Initiated by FortiOS VPN or Management Daemon
id: 57bae0eb-d167-5da3-a2e0-0d5ddde67474
status: experimental
description: 'Detects outbound network connections initiated by FortiOS/FortiProxy
  processes

  that normally only accept inbound connections (sslvpnd, httpsd). Outbound

  connections from these daemons can indicate a reverse shell or C2 callback

  established after successful exploitation of a heap overflow RCE vulnerability.

  This is a low-volume, high-signal behavior that should be tuned against known

  legitimate update/telemetry endpoints for the specific appliance environment.

  '
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
    - /sslvpnd
    - /httpsd
    Initiated: 'true'
  filter_updates:
    DestinationHostname|contains:
    - fortinet.com
    - fortiguard.com
  condition: selection and not filter_updates
falsepositives:
- Legitimate FortiGuard update, licensing, or telemetry connections initiated by the
  daemon itself
- Outbound connections to configured syslog/SNMP/webhook endpoints as part of normal
  appliance operation
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20230613.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e0e876ad-dcf1-5773-adbb-5bd6be75b83b/fortios-heap-overflow-enables-unauthenticated-rce.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup