Everyone is trying hard and it shows in the results.

The people I work with ALL care about delivering quality and delivering well. Essentially, the patched version added a check before performing a number of actions, which obviously seemed promising.More than 2 years in, I'm still thinking that this is the best place I have worked in the dozen (at least) places I've worked at during my career. However, some interesting information is revealed, particularly in the two following images:īug ID referencing problems when sending large POST requestsĪ couple other differences stuck out, such as the one in the code snippet below.

The details regarding how the vulnerability is actually exploited are obviously lacking. However, most of the article is focused on the post-exploitation and provides a number of indicators of compromise. They also mention that the vulnerability is actively being exploited by threat actors, which means that it must actually be exploitable and not just some denial of service issue.Ī follow-up article on Fortinet’s blog provides some insight into how the threat actors were operating. I’ll blame my poor googling technique…įortinet explain in their advisory that the vulnerability is a heap overflow in the Fortigate’s sslvpnd daemon. I’ll show later on that other information was already out there, but at the time I couldn’t find it. I started searching for information regarding the issue early January 2023 and couldn’t find much information outside of Fortinet’s own advisory and blog post explaining what threat actors were doing with the vulnerability. Given the relative lack of information surrounding it at the time, and the fact I’d have some uninterrupted research time due to a lengthy flight, I decided to attempt to produce a POC for the vulnerability. Late last year a new remote code execution vulnerability was discovered in Fortinet’s SSLVPN service.

What is fortinet