Improper Authorization in Fortinet FortiOS & FortiProxy SSL VPN Web Portal Allows Password Modification (CVE‑2018‑13382)
What It Is
Fortinet FortiOS and FortiProxy contain an improper‑authorization flaw in the SSL VPN web portal. An unauthenticated attacker can submit crafted requests to the portal and change the password of any VPN user without possessing valid credentials.
Exploitability
The vulnerability is publicly disclosed and assigned CVSS v3.1 7.5 (High). Proof‑of‑concept requests have been published, confirming that exploitation requires only network access to the SSL VPN interface. No evidence of widespread active exploitation has been reported, but the ease of unauthenticated abuse makes it a credible threat.
Affected Products
- Fortinet FortiOS (all versions prior to the vendor’s security advisory fix)
- Fortinet FortiProxy (all versions prior to the vendor’s security advisory fix)
Why It Matters for Compliance & Audit Readiness
- Access Controls: The flaw bypasses authentication, directly violating the principle of least privilege and undermining access‑control policies required by frameworks such as NIST 800‑53 AC‑2 and ISO 27001 A.9.2.
- Vendor‑Management Controls: Reliance on a third‑party network‑security platform obligates organizations to demonstrate due‑diligence in patch management and security‑baseline verification.
- Continuous Control Monitoring: Detecting unauthorized password changes through log analytics provides defensible evidence for auditors and supports a trustworthy audit trail.
- Audit Trail & Evidence: Remediating the issue and documenting the remediation steps (patch status, configuration hardening, monitoring rules) satisfies control‑assessment requirements for SOC 2, PCI‑DSS, and other regulatory regimes that demand proof of effective vulnerability management.
Recommended Actions
- Patch Management: Verify that the FortiOS/FortiProxy instances are updated to the vendor‑released patch that resolves CVE‑2018‑13382. Capture patch‑installation logs as audit evidence.
- Access‑Control Hardening: Enforce multi‑factor authentication (MFA) for all SSL VPN users and restrict VPN access to known IP ranges where feasible.
- Log Monitoring: Enable detailed logging of VPN authentication events and password‑change actions. Deploy a SIEM rule to alert on any password change initiated from the SSL VPN portal without a preceding successful login.
- Vendor‑Management Review: Update your vendor‑risk register to reflect the remediation status of this vulnerability and schedule periodic verification of Fortinet product baselines.
- Evidence Collection: Archive configuration snapshots, patch‑verification reports, and monitoring rule definitions to demonstrate control effectiveness during audits.
Source: https://nvd.nist.gov/vuln/detail/CVE-2018-13382