Critical Path Traversal in Fortinet FortiOS SSL VPN (CVE‑2018‑13379) Enables Unauthenticated File Download
What It Is – Fortinet FortiOS SSL VPN web portal contains a path‑traversal flaw that lets an unauthenticated attacker request arbitrary system files via crafted HTTP URLs.
Exploitability – Publicly disclosed in 2018; proof‑of‑concept scripts are available and the vulnerability has been actively exploited in the wild. CVSS v3.1 base 9.8 (Critical).
Affected Products – FortiOS 5.6.3‑5.6.7, 6.0.0‑6.0.4, 6.2.0‑6.2.3, and any FortiGate appliance that enables the SSL VPN web portal.
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The flaw bypasses authentication, highlighting the need for strict remote‑access policies and segmentation.
- Continuous monitoring – Detecting anomalous VPN file‑download requests requires logging, alerting, and evidence collection that can be presented in audits.
- Defensible evidence – Demonstrating that VPN configurations are patched and monitored satisfies a core control objective across SOC 2, ISO 27001, NIST CSF and other frameworks.
Recommended Actions
- Apply Fortinet’s latest FortiOS patches that remediate CVE‑2018‑13379.
- If the SSL VPN web portal is not required, disable it to reduce the attack surface.
- Enforce least‑privilege VPN accounts and MFA for all remote users.
- Enable detailed logging of VPN file‑access requests and integrate logs into a SIEM for real‑time alerts.
- Conduct a post‑patch vulnerability scan and retain evidence of remediation for audit readiness.
Source: NVD – CVE‑2018‑13379