title: Fortinet CVE-2018-13379 Exploitation
id: a2e97350-4285-43f2-a63f-d0daff291738
status: test
description: Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs
author: Bhabesh Raj
references:
  - https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/
date: 2020/12/08
modified: 2022/01/07
logsource:
  category: webserver
detection:
  selection:
    c-uri|contains|all:
      - 'lang=/../../'
      - '/dev/cmdb/sslvpn_websession'
  condition: selection
fields:
  - client_ip
  - url
  - response
falsepositives:
  - Unknown
level: critical
tags:
  - attack.initial_access
  - attack.t1190
