CVE-2018-13379

CVE-2018-13379 is a critical vulnerability that affects FortiOS and Fortiguard, presenting a flaw in their software design or implementation. This specific vulnerability, which can expose sensitive credentials, has been frequently exploited, making the top 15 most routinely exploited list in both 2020 and 2021. It is one of the oldest vulnerabilities still being actively exploited, dating back to 2018. It's particularly notable for its role in facilitating initial access to victim networks by threat actors. The Play ransomware group has been known to exploit this vulnerability, among others, as part of their attack strategy. They typically gain initial access to victim networks by abusing valid accounts and exploiting public-facing applications. Specifically, they have exploited known vulnerabilities in FortiOS (CVE-2018-13379 and CVE-2020-12812) and Microsoft Exchange (ProxyNotShell CVE-2022-41040 and CVE-2022-41082). The Fortinet SSL VPN vulnerability (CVE-2018-13379) was the most routinely exploited bug last year, followed by the ProxyShell bugs and a flaw in Zoho ADSelfService Plus (CVE-2021-40539). More recently, an Advanced Persistent Threat (APT) actor leveraged the Fortinet VPN vulnerability (CVE-2018-13379) for initial network access and a Windows Netlogon vulnerability (CVE-2020-1472) to gain access to Windows Active Directory servers for privilege escalation within the network. These ongoing exploitations underscore the importance of patching even older vulnerabilities like CVE-2018-13379, as they continue to present significant security risks.